Try the event log of the offending machine for clues, switch on memory logging to look for creep, and review the process for any 'over ambitious' logic such as unfettered polling loops, excess logging, incomplete close down of apps (eg Excel), Db connections left open, multiple instances of large collections etc, etc.