Hi Mate,
Interesting problem. It would drive me round the bend.
CID, as you know, is generated as part of the sip control sequences being sent from the phone.
Areas to look first. Check sip.conf to see if the rogue CID appears anywhere. While you're at it do a search on the selintra database with
cat /home/e-smith/db/selintra | grep nnnn
substitute the rogue extension number for nnnn.
If that doesn't show the rogue CID then it is almost certainly coming off the phone itself. You can prove this by watching the SIP invite stream during call set-up. You'll need ethereal...
Install ethereal with
yum install ethereal --enablerepo=base
Then run
tethereal -i ethn host nnn.nnn.nnn.nnn
substitute the phone's address for nnn...
If the phone is remote then you should watch eth1. if the phone is local, you should watch eth0.
Stop ethereal with ^C
For a detailed view of the SIP packets run...
tethereal -Vi ethn host nnn.nnn.nnn.nnn
This should show you what's in the invite and what CID's are flying around.

Kind Regards
Selintra