This is a half hour windows, I would suggest performing esxtop in replay mode for that time windows using vm-support, and this way you can replay the esxtop and examine which lun/vm is generating the load. Here is how to prepare for replay, you will need to setup a cron job couple minutes before these peaks.