Windows DHCP server Rogue Detection algorithm

I'm getting rogue DHCP traffic leaking in from my ISP, through my router, and my Windows DHCP server is shutting down.

What does MS Widows DHCP server 'Rogue Detection' detect?

At least so far, none of my clients have taken a WAN IP address from the ISP.

I've never had this problem with other ISPs, using the same routing equipment.

As well as doing vast network captures over several days to try and find the problem, I'd like to know if there is anything specific I should be looking for: not just DHCP traffic, but specifically, DHCP traffic that triggers "Rogue Detection" for Windows DHCP server.