system spid regularly allocating in tempdb but not deallocating

Early this week we had a system spid that was constantly allocating in tempdb but not deallocating:

SELECT s.session_id, dbu.database_id
    , SUM(dbu.internal_objects_alloc_page_count) internal_objects_alloc_page_count
    , SUM(dbu.internal_objects_dealloc_page_count) internal_objects_dealloc_page_count
    , (SUM(dbu.internal_objects_alloc_page_count) - SUM(dbu.internal_objects_dealloc_page_count))  * 8096 / 1024 kbytes_used_internal
FROM sys.dm_Exec_requests r
INNER JOIN sys.dm_exec_sessions s ON r.session_id = s.session_id
LEFT JOIN sys.dm_db_task_space_usage dbu ON dbu.session_id = r.session_id
    AND dbu.request_id = r.request_id
WHERE internal_objects_alloc_page_count > 0
GROUP BY s.session_id, dbu.database_id
HAVING SUM(dbu.internal_objects_alloc_page_count) - SUM(dbu.internal_objects_dealloc_page_count) <> 0
ORDER BY kbytes_used_internal DESC;

The drive space for our tempdb was at 90% full.  We restarted the service and this morning the same symptoms exist.  I cannot connect this process to anything so i will present all the information i have and solicit suggestions for how to get more information.  This is a 2008r2 sp2 CU4 instance.

In the SQL above SPID 25 is the culprit and here is the output:

session_id	database_id	internal_objects_alloc_page_count	internal_objects_dealloc_page_count	kbytes_used_internal
25	2	36960	0	292215

It hasn't grown that much - yet.

An attempt to find out what it is doing:

SELECT DB_NAME(r.database_id) dbname, s.host_name
	, SUBSTRING(t.text, r.statement_start_offset /2, CASE r.statement_end_offset WHEN -1 THEN LEN(t.text) ELSE r.statement_end_offset / 2 END - r.statement_start_offset /2) executing_text
	, s.host_name, s.program_name, s.login_name, s.login_time, s.last_request_start_time
FROM sys.dm_Exec_requests r 
INNER JOIN  sys.dm_exec_sessions s ON r.session_id = s.session_id
OUTER APPLY sys.dm_exec_sql_text (r.sql_handle) t
WHERE r.session_id = 25

yeilds:

dbname	host_name	executing_text	host_name	program_name	login_name	login_time	last_request_start_time
master	NULL	NULL	NULL	NULL	sa	2014-01-22 22:35:44.330	2014-01-22 22:35:44.330

I turned every event on in profiler for this spid.  That yields these events

Scan:Started
Scan:Stopped

The database for all of them is tempdb and the read count value is always greater than zero.  Occasionally, two more events are squeezed between:  Lock:LockReleased and text data is a file:pageno format.

That session isn't in a transaction and isn't holding any locks that are reported by:

SELECT * 
FROM sys.dm_tran_locks 
WHERE request_session_id = 25

It is regularly waiting on the waittype:  BROKER_EVENTHANDLER.

That is all i know and all the dots i have been able to connect to this point.  I know it isn't much but i would certainly appreciate any 'where to look next' ideas.

thanks

danny

-- dan http://dnhlmssql.blogspot.com/