Cache seems to be working as expected and I think a lot of obtained records have very low TTLs that are honoured by Windows DNS server as expected and cause the same types of queries to repeat.

We looked at DNS cache for a bit as well. By way of forwarders and/or root hints those end up on the Internet and as they pass through his LAN router, it brings the router to its knees after a while. This combined with other hosts on his network are generating a sum total of over 1,000 requests a minute to his DNS servers when we took a sample a few days ago. The primary workstation he's looking at is generation DNS requests at a rate of about 320 requests per minute or 5 per second, without a break. Looks like the purpose of this new discussion is more along the lines of how to troubleshoot a single workstation and why it was so 'chatty'. That part is figured out in this discussion here: We've covered how to get debug logs, how to analyze them, get reports, etc. We had a lengthy discussion a few days ago with the OP regarding DNS debugging.

Speaking on behalf of the OP as responses now start to go back full circle to a discussion from the other day.

What is a safe tcpview program