Odd suggestion would be web-panel control of the NTP settings. Right now they are using the public ntp pool by default, and there's lots of oddball sites that are connected to. The date information has proven to be fairly incorrect lately, and some machines exchange abnormal amounts of packets with these random servers. I randomly came across one that belonged to a Satan worshipper IRC that miners were connecting to for NTP and exchanging an unusual amount of packets on the regular (10x or more from a normal ntp response). Just looks sketchy.
I have had NTP flooding problems on my network due to the large number of miners that I run. What I ended up doing was running an NTP server in house and using my ASA to reroute all NTP traffic to the internal server. This and an in house dns server really took the strain off of my security devices because these miners do make an insane number of NTP requests.