First of all, you shouldn't have so big broadcast domains to have even 15k MAC addresses on access switches. Either separate them by VLANs (with connectivity at L3, with routing), or at least with any kind of traffic segmentation (if the endpoints don't have to communicate with each other).
The problem itself looks like VLAN misconfiguration (or device malfunction) - I guess you don't attach VoIP phones to 802.1q tagged interfaces, but plug them into untagged ports. There are switches that allow to set multiple untagged VLANs on a single port, with the traffic being passed into PVID of that port ...but learning MACs and passing incoming broadcast frames. There are switches that won't allow to disable default VLAN (VID=1) despite using other PVID on the port.
The second cause happening in the wild is a single device malfunction or misconfiguration, effectively "bouncing" (usually broadcast) frames into another VLAN that is available to that device. This happens even without asymetric VLAN configurations and is not a big surprise when it happens on low-cost SOHO devices. Smaller broadcast domains make it easier to pinpoint such misbehaving device, by looking if the specific MAC address doesn't ocasionally pop up on a wrong port of a switch.
The only question you need to ask yourself is - what is the path of the VoIP phone to a different VLAN? How is it leaking? Very easy to check on a one-switch one-phone testbed.