Are you able to log into the SSG5 during the incident?
Do the policy logs for internet access show hits during the incident?
Do you have monitoring in place that can tell what the cpu utilization and bandwidth use is at the time of the incident?
How does routing switchover work from local internet to MPLS?
Can you do an internet site traceroute during the incident to verify routing is out the expected path.