You've got a couple of options on how in depth you want to get into this.
Take the server completely offline, boot one of the forensics boot disks and start looking for anything that changed that might be the actual OS. /usr/bin/ /usr/lib /etc/ /sbin and obviously ignore /usr/portage.
install rkhunter and run it. If the box is severely compromised it may not find anything, but it's worth a shot.
Packet sniff the ethernet port of the Gentoo server from another machine, you'll need access to the switch and a managed switch to do this correctly. You can try sniffing from the machine itself, but again if it's severely compromised you might not see anything.
If you control a firewall between your server and theirs try adding some permit rules on the RPC ports with logging.
Assuming you still think the problem is actually on the other end, call a meeting. Ask for application logs, errors, system logs, etc. Take the whole thing seriously. Way seriously. If your server has been compromised then theirs might be too and they have to completely rebuild their machines. All of them. Unless somehow we can figure out what really happened. The threat of a full system reinstall is usually enough to make people cough up what really happened, but tailor this to your actual political capital, groups, etc. Sucks, but sometime politics has to be played. May as well play it well.
Lastly, if your Gentoo machine has been compromised you'll have to rebuilt it from scratch. Even taking it offline, chrooting and running emerge -e world won't clean it up.