If they are blue screening?...configuring the computer to create a full memory dump would be best. With a full memory dump in hand (will be the size of RAM) I would suggest running it through WinDbg which is essentially the Debugging Tools for Windows component of the SDK. You will need to configure symbols, load the dump and use the command:
!analyze -v
to see if there is anything obvious in terms of pinpointed problematic drivers, what's modules on the crashing stack, etc...
If this doesn't help, open a ticket with Support, they will probably ask you to upload the memory dump to their FTP server.
Beyond the above, you could attempt to disable various components of the endpoint software to narrow it down but the dump process is going to be the sure fire way of getting the answer.