First thing I would do is identify at which time rsync is being run. You can do this with auditd
Put a watch on rsync executable on your server
auditctl -w /usr/bin/rsync -k rsync
Then you can periodically check if auditd logged any access like this
ausearch -i -k rsync
Once you know times when rsync runs - you can now identify which remote hosts use it.
See process tree and identify what rsync uses
pstree -p|grep -i rsync
And check which remote hosts are connected to PID 26209
netstat -anp|grep 26209
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 26209/sshd
tcp 0 0 10.10.10.20:22 10.10.10.40:64740 ESTABLISHED 26209/sshd
tcp 0 0 ::1:6010 :::* LISTEN 26209/sshd
All this assumes that rsync actually takes some time, so you can execute those pstree and netstat commands. If rsync is very quick - there are other ways to do tracing, but it will be more heavy (systemtap is on my mind for this, but start from simple and if that doesn't work - we will discuss more complex solutions).