1) Found IP of server ffxiv.exe was connecting to while logged in to my primary server with netstat:
> Run cmd.exe with admin privileges
> Run the following command: netstat -ab > results.txt & results.txt
(literally this pipes the output of the command line into a file named "results.txt" and then opens the file)
I'm on Balmung. This resulted in the IP 199.91.189.33.
2) Ran traces using winMTR for several minutes while experiencing severe lag (NOTE: never had any lag issues until about 2 nights ago when Balmung went down about 3 hours before the scheduled maintenance). Results:
Trace # 1
Small amounts of packet loss are notable on a few of the hops, but the last 2 hops show significant packet loss. This could possibly be resulting from the packet loss on earlier hops, so I ran a similar trace of a much shorter duration to see where the packet loss becomes evident first. A second trace of similar duration ended up with very similar results.
Short Trace # 1
Here we can see the packet loss starts at 199.91.189.234 and likely trickles over to 199.91.189.33.
Whois results:
[Querying whois.arin.net]
[whois.arin.net]
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
#
# Query terms are ambiguous. The query is assumed to be:
# "n 199.91.189.234"
#
# Use "?" to get help.
#
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=19...se&ext=netref2
#
Ormuco ORMUCO-FIBER-NETWORK (NET-199-91-184-0-1) 199.91.184.0 - 199.91.191.255
Eidos ORMUC-SE (NET-199-91-189-0-1) 199.91.189.0 - 199.91.189.255
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
Looks like 199.91.189.234 (Ormuco) would be where I'd start poking around. Given the trend we've seen lately, I'd hazard a guess that we've got some overloaded infrastructure or faulty hardware at that hop.
Hopefully SE can start putting this to use in investigating this issue. Others can use the same method to investigate further on their own end as a single tracert isn't enough evidence to see what's going on.
Best of luck to all.