Any poor conductors, be they rusty screws, rusty tower sections or dissimilar metals can produce a pseudo diode junction resulting in PIM so yes this can be a challenging search to find out where the noise is coming from.
I work on a lot of 6 meter and 10 meter systems and the best search tool for me is a 4 to 6 foot long two by four piece of wood which I use to smack and bang on anything nearby that is metallic such as the tower itself, nearby metal buildings, building doors, siding on buildings, ground connections.
Anything that is remotely close to being metallic near my systems have caused the PIM issue, I use the wood two by four board to search out the noise source while listening with a hand held radio to the repeater output and this has been the best tool for me.
One 6 meter repeater in central Arizona took us a couple of months to first eliminate a nearby cellphone companies switches and Multiplexers which were creating noise masking some poor metallic connections that were resulting in unknown PIM sources.
Once the cell companies noise sources were lowered by around 15 to 20 db we next faced finding several latent PIM sources which showed up and these then took another month or two to search and eliminate.
For this 6 meter repeater it took so long because it was on a 8000 foot mountain in the dead of winter with 4 feet of snow on the ground.
Do not overlook any nearby metallic on anything, look at buildings, doors on buildings, metal or aluminum siding on buildings, loose connectors on anything, light fixtures poor screws on electrical wall plates.
Look at nearby lighting systems, poor AC electrical systems, everything and anything metallic or closely metallic should be considered suspect to causing PIM issues.
If your repeater is in a more mild environment then it may only take a couple of weeks or even days to search and eliminate the noise sources.