Had a similar problem to this, where Abbrev dial numbers were being called.
What are some of the extension numbers getting the calls? My guess would be extensions numbers with digits that are mostly 1's and 2's. A failing external cable on the property with analogue extensions attached was the culprit. (Pull the analogue boards for one night and see if it stops) It can be H/R connections on lines, faults in pits and joints, or just one dodgy phone going short and open on an analogue card. A short cct line going intermittent open can simply dial ones or twos easily. Change the extension number to 189 or 1899 instead of 111 or 1112 ... and the problem goes away.
Night time drop in temperature will shrink your copper wires and connectors and cause bursts of analogue digits. (Sometimes need a bit of rain to get a short circuit too.) Testing your analogue extensions with a meter might point to the culprit.
I changed the numbering of the speed dials as a temporary measure, so that the "on-call" employee could get some sleep at night until the fault was found. The final result was a failing 50 pair cable that had to be replaced at considerable expense to the customer but it resolved the phantom rings instantly.
Regards, Munz
