The information would've possibly been discovered on a bank statement for an unknown debit. Natural response would be to ask the payroll people or the practice manager. As the owner of the business, you have every right to know how funds are being allocated.
Putting the ethical dilemma aside, I would say a combo of 2,3, and 4. Employer dictates the pay structure so going to the employee or attorney isn't the best idea for that information. That's usually outlined in an employment agreement/handbook.
It sounds like you believe they are discretionary bonuses but the practice manager thinks they are earned bonuses (based on hours worked or something similar). It all depends on what's in your employment agreement/handbook.
First thing to find out is how much has been paid in bonuses either from the accountant or the payroll company. If you find that money is being embezzled out of the business, then it's time to get the attorney involved.