We’re on the same page - this was a first pass and I think a lot more could be done. My first choice would be detecting DHCP servers giving out addresses without internet connectivity (i.e. a “rogue” DHCP server). It’s so easy to accidentally plug in a router when what you want is a switch and not realizing it has a DHCP server enabled. I find this especially true with something like an Ubiquiti EdgeRouter or the like since it can be a switch or a router depending on configuration.