I have a request from our network admins for a way to identify Symantec Endpoint Protection (SEP) Certificate Revocation List (CRL) traffic as part of a larger troubleshooting project. 

Is there a way to specifically identify this traffic from SEP?

THank you

You can sniff the traffic using wireshark on 443, although it's encrypted obviously so you need to setup wireshark to decrypt it.

Whats the purpose of this?

Have you manually installed any other certificate apart from the Default one. which is explained here.

About server certificates

The network admins are looking into some traffic and congestion issues we are having.  They are trying to identify each item and eliminate them as a source of the trouble.

Usually, it comes down to content updates on port 8014. Anything like this showing?