The hold message typically comes from the CUCM/Router/3rd party, vs the telephone.  You should be able to see the far end point ip address change when the call is placed on hold and that should hint you on where it is coming from (Internal/External)....