One thing you can do occasionally is use the show event alert command to see what kinds of alarms the IPS is generating and what it is doing with these alarms. Depending on the level of information you want you may need to configure your IPS to prod...
Here this guide can walk you through using your IPS to display and capture live traffic: http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_packets.html
Running a virus scan on the source IP address is a good first step. If you come up with nothing then my next step would be to check the source for any misconfigured scripts or applications that may be causing the host to repeatedly reach out across ...