Thank-you all for your replies.
tl;dr - TAPI driver and Endpoint Outlook integration do not play well together. Removing TAPI driver temporary workaround.
I had a major issue with the domain just after I posted this so could not focus on this issue. As this issue was happening to many users I had to implement a workaround of disabling EAV Outlook integration which stopped the issue completely.
I have since been able to re-visit the problem.
I managed to get the issue to repeat fairly consistently by opening and closing Outlook many times, which would eventually cause the problem.
We use Xarios Phone Manager which links to our phone system and when coupled with EAV Outlook integration cause the process that hosts the Telephony (TapiSrv) service to 'lock'. This process also hosts DNSClient (problem pinging addresses via DNS name and Endpoint Security unable to connect to update server), Workstation (SMB weirdness) and some others. The only way to recover from this lock is to kill the svchost.exe process that spawned these services.
As we do not use the TAPI funstionality in any software yet it is an ok workaround to remove the TAPI driver.
Go to Control Panel > Phone and Modem
Open Advanced Tab Remove Xarios TAPI Service Provider EAV Outlook Integration is now ok to use.
We would like to use the TAPI integration in the future so will need to get the driver back in at some point, so this is only a temporary solution.
Other things that have been tried:
Reinstalling EAV
Uninstalling EAV, cleaning installation, reinstalling
Tried remote install and local install of EAV
Disabling HIPS
disabled telephony service only
Removing Xarios phone manager from realtime file protection.
Removing Outlook TSP integration using Xarios installer
Reinstalling Office
Repairing Office
Removing C:\Windows\System32\*.* from Realtime file protection (could not get it to crash but may have been a fluke)
Disabling telephony service (still crashed when left on overnight)
Disabling dnsclient and telephony service (could not get it to crash but dnsclient is needed on our network)
And of course disabling EAV Outlook integration which stopped the crash but leaves Outlook vulnerable.