Have you checked the Tokencache?
SELECT GetDate() as TimeofCapture, SUM(single_pages_kb + multi_pages_kb) as "CurrentSizeOfTokenCache(KB)"
FROM sys.dm_os_memory_clerks
WHERE name = 'TokenAndPermUserStore'
We had an issue where our server just ended up being very...