So you don't actually know where the traffic is coming from yet...?
If I see a server's bw shoot right up I usually do a dump of the raw IP packets and search for "GET /..." strings to figure out which of the 15-20 sites on that server everyone is suddenly hitting more.
