lsass.exe opens many connections to the dc on port 135, but no vir

Ok,
I am having a lot of issues with several of my servers loosing network
connections. when i do a netstat -n(or tcpview) i see a lot(and increasing)
amount of port 135 connections to the dc. tcpview shows that the process is
c:\window\system32\lsass.exe I know what your saying....sasser! but i have
used spybot and a virus checker and both the dc and the other servers come
clean. when this happens, i need to restart the server to make things work
again. Anyone have any ideas on why i have lsass.exe opening so many
connections???

thanks