Thank you Tara and The Hack Repair Guy for the responses!
Is there any tips or tricks that might help me target a general area to focus on? I was going to attempt to start the process of elimination with the plugins, disabling them one at a time and seeing if it will occur again.
The site is pretty large and complex, it would take days to comb through it all.
I am really regretting not making a backup closer to the hack date