Oh dear, that's a fun one.
Do you have any idea what they're used for? Can you narrow it down to "these were used for network services", or could it really be anything at all?
I would say a packet capture on each server is necessary, along with an audit of all running services. Locate the config files for each running service and check when the files were last updated - that will give you a clue as to whether something has been customized, and if so, how long ago.
You can also run a port scan on each server to see which ports are open and responding.
You can get clues by querying known network services - EG, DNS, LDAP, etc. You should be able to find a list of all DNS servers for a particular zone by digging for NS records. Bear in mind that you may end up with a longer list of NS records than there are actually active DNS servers, but it'll give you a starting point.
None of these methods are sure fire by themselves, but if you throw multiple audit methods at a particular box your chances of finding everything worth finding is enhanced.