I've not spotted a SP related command on the CLI, I'd maybe look for the user connection with;
showuserconn
Look for an IP that is not your SSMC/IMC/CLI boxes.
Although I noticed that the behavior changes between 3PAR 3.2.2 and 3.3.1;
showversion
On 3.3.1 the SP seems to be connected all the time, on 3.2.2 I think it only logins occasionally to gather some logs and then logouts (making it hard to spot).
Also something that might work is checking the event log for the SP user running commands;
showeventlog -msg 3parsvc.* -min 240
Should show the IP there too.
I can't remember if the virtual SP was an option when the 7000 was first released, we've always ended up with physical ones, hopefully you can track it down either way via the IP.
![Smile :)](./images/smilies/icon_e_smile.gif)