Calls cannot come from inside the system from an extension that does not exist... if they are truly internal calls, the device exists somewhere, but the clue here is probably that you just went to a PRI, which sends DNIS digits for each incoming call, and you are probably getting the incorrect number of digits or do not have one of the DID digit strings defined properly so it is rerouting to the attendant or some other destination and appears to be an internal call.
Tracking these down can be tough if they don't know up in SMDR, are you looking at raw SMDR data or a report from call accounting software? Sometimes CCA software will discard very short calls such as those under 5 seconds.