Hello Vlad,
ARPs more than 15pps does not look legitimate.
I would run a sniffer software ( like Wireshark) on the Machine, where we have a probelm. This will give us a better insight into the problem.
Few questions to analyse.
1. What is common between the machines that have the probelm? vlan ? Same closet switch ?
2. Can you share your DAI and DHCP snoop config from the switch.
3. What happens if those problmatic machines are plugged directly to the ports, removing phones from the picture ?
Regards,
AB