All wires hot in 3-wire cable to 3-way switches?

Need help identifying wires and solving a mystery of everything being hot. Ultimate goal is to install a zwave switch on this circuit, requiring me to identify hot, load, traveler, and neutral.

I just moved into a new house and noticed several electrical gremlins that I’ve been picking away at. Most were simple like three-way switch common/traveler swaps. However, there is a three way in the basement that has me scratching my head.

I know of two switches that control our basement overhead lights. In both boxes, 3-wire goes to the switch with common and two travelers. Both boxes are 2-gang switches. In both boxes, all three wires in one of the 3-wire romex cables coming into the box are hot.

This one needed a diagram, see below. On the box at the base of the stairs, there are three 2-wire entries, two of which go to a black/hot pigtail and white/neutral pigtail. There is a 3-wire romex for the overhead lights, where the red wire is hot,
a white wire is hot, and a black wire with white paint is hot, although it goes to a hot pigtail. Another black/white-paint wire from a separate romex was originally wired to the common screw of the original three way I removed because the switch had cracked. There are also two 2-wires o’ mystery that are just connected to the hot pigtail (black) and neutral pigtail (white) and sit in the back of the box, silently taunting me. This box is shared by a functional three-way zwave switch to the stairs light.

On the box by the exterior door, the red wire, black with white paint, and white are all hot. That box is shared with a simple on/off light on a separate circuit and no wires are shared.

A couple of questions:

1. I assume this means that power is coming in from one of the overhead lights, and not into the boxes- would this be correct?
2. Does the fact that all travelers are hot hint that there may be a third switch to the lights that I just haven’t found yet?
3. Is something shorted in one of the lights to make all these wires hot when the switches are removed and wires separated? Every there-way I’ve worked on in the house so far has only a single hot wire among them all once everything is opened up. Is there possibly something dangerous afoot?
4. Do I need to separate anything from that hot pigtail in box 1?
5. Which wires are the hot, load, neutral, and traveler I should use to replace the cracked switch with a zwave switch? I’m assuming I’ll keep red as traveler, but I’m confused by everything else being hot.

edit:
thanks for the tips!
I was planning on using the GE/Jasco Zwave switch in box 1 and the GE/Jasco add-on switch (with only traveler and neutral terminals in box 2. For now I replaced them with "dumb" switches using the original wiring, just not the cheap cracked plastic ones that were on there before. I have a multimeter, I just haven’t pulled it out among the other unpacking yet- will definitely give it a shot.

If going to a smart switch, Would box 2 then need to use solution #2 from this link? Basically capping off the black on both ends of the traveling /3 wire and using the white through it as neutral. These smart switches don’t require full voltage at the add-on site (in this case, box 2) as the single traveler is used to pass digital signals to the main switch.