Had a site that the system will randomly lock up and stop processing calls and displays on all phones will go blank. System has to be removed from network, powered down and restarted to return to service.

Looking in the alarm log, the only issue we see is IP Collision. NTAC said to run a Wireshark test to look for any ARP probing to 0.0.0.0, which we actually did find. The customer's camera system was doing exactly that. Disconnected it and the ARP probe stopped. System ran great for another week and did it again. Alarm log still only shows an IP Collision. There is nothing probing to 0.0.0.0 and we have scanned the network to look for a duplicate IP address but nothing is showing up.

NTAC wants Wireshark logs from normal use as well as one from when it fails. There is no rhyme or reason as to when it fails so trying to start it before it fails is tough.

Anybody ever had anything similar?

System is a SV9100 CP10, version 10.60.53 with Netlink plus two IP terminals so removing from the network for any length of time isn't an option.

The traces NTAC is asking for will tell them what is causing the lock ups, as you already know. Getting the Whireshark trace when the system locks up is the problem, if you don't have a spare laptop try to borrow one. You won't have to knock the Netlink or the IP terminals off line (only for a short time for setup) to perform the trace.
Have the customer call you as soon as the system locks up and have them stop the trace after the 9100 boots up.
Good luck.

I would bet something on the network is spamming the NEC causing it to lock up.

If your phone isn't on it's own VLAN it needs to be. We ran into issues like that in the past just from all the trash on the regular data LAN. We won't install a system without a VLAN in place any longer.