The screenshot above indicates that on the St. Louis interface belonging to New York Core Router practically whole incoming traffic (98%) came from the source 172.16.6.86.
Besides that, it is notable that 172.16.237.2 had atypical outgoing behaviour between 11 and 13h.