1. Enable DNS Debugging logs from DNS Server properties (dnsmgmt.msc)
2. Configure detailed logs for few hours & observe in the logs
3. Check , what kind of query & which is the destination.
4. Verify all queries are getting forwarded to root hints ?
5. Else check at client level & DNS Server level for Virus ,
6. If all directing to Roothints - do below steps to block same.
7. Disable Recursion ( will disable Forwarders Also ) or Enable standard forwarding to another DNS Server.