Went with Garrison Neely's answer in comment above:
Instead of marking every class as Serializable, look for the ones that are being sent back and forth between your site and state service. Hopefully that's a smaller list. – Garrison Neely Jul 12 at 20:50