Use a digital storage scope, many of them can directly decode protocols like SPI . Then a lot of trial and error to figure out when exactly the issue happens and what else is happening around that time.