The suspicion that comes to mind based on the environment (win2k3) and symptom (which sounds like non-page pool memory depletion), is the issue I describe here:
Navigating Mines, second issue in the table.
If you want to confirm it, configure the system to allow being dumped via keyboard. Next time they report "unresponsiveness"+"can't RDP", they should know to force a dump to occur.
If it is the issue I'm thinking it is, we have no solution for you - but we do have a resolution. The problem can be avoided, or controlled. And while it's true they can say "I told you it was McAfee" you can respond in kind with "Yes, and it only occurs for Server 2003... two-thousand-and-three, what year is it?"... if you wanted to.