Random broadcast from UAP ports

I'm asking for tips & tricks to troubleshoot our customer's(senior high school) WiFi problem.

We are using Aruba 2540-48G-Poe switches and Unifi-UAP-PRO/HD/SHD in our site. We have configured fault-finder broadcast-storm limit(warn&disable 600 pps 300) on our switches. During normal schoolday one or two port gets closed randomly by fault-finder and broadcast-storm. And it's always the port where access point is connected. So i'm suspecting that the device sending broadcast could be student's laptop or something else. This started happening in last week, and we haven't made any changes to the network.

So i decited to mirror and monitor those AP ports with wireshark. Now i have captured few gigs of log from them, and managed to get log's from the port where broadcast-storm was happening.. So i'm asking for an advice, what i need to filter out from those logs to get closer my suspected device?

​

If i forgot to mention something that needs to be said, please do tell me.