I wonder what makes you think this could be related to ARexx in any way. FINDINPUT is a DOS packet generated by the Open function, here called like Open(filename,MODE_OLDFILE).
The Open probably is in the SnoopDOS log just above the FINDINPUT packet. You should not enable packet monitoring unless you really know what you are looking for. The Open log entry also names the file which is tried to open. Unless it is something like PAR: or PRT:, it is completely unrelated to the printer.
The originating process name is listed in each line of the SnoopDOS log in the column left of the action.
It would be better if you post the entire SnoopDOS log so that it can be interpreted by someone who can actually read it instead of just digging in the dark.
