During a network investigation, an analyst captures traffic on a switched LAN segment and notices multiple ARP reply packets mapping the default gateway's IP address (192.168.1.1) to two different MAC addresses within the same minute. Several hosts on the subnet are also experiencing intermittent connectivity and unusually slow browsing. Which activity does this pattern most strongly indicate?