Modern enterprise networks face an escalating volume of sophisticated cyber-attacks that traditional signature-based network intrusion detection systems (NIDS) fail to counter. Existing machine learning (ML)-based NIDS (ML-NIDS) exhibit three fundamental operational limitations: (i) dependency on proprietary flow exporters that create vendor lock-in and restrict privacy-sensitive deployments; (ii) susceptibility to class imbalance that degrades generalization across heterogeneous attack categories; and (iii) opaque decision processes that erode operational trust and hinder alert triage. These gaps collectively prevent ML-NIDS from achieving reliable, reproducible, and explainable detection in real-world deployments. This paper presents a new packet capture artificial intelligence detection engine (PCAPAIDE), an open-source hybrid NIDS that addresses all three limitations through four coordinated contributions: (C1) a self-contained 35-dimensional flow feature extractor operating directly on raw PCAP or standard CSV records, eliminating exporter dependency; (C2) stratified reservoir sampling with a class of weight-balanced random forest (RF) classifier, providing imbalance-resilient training on datasets exceeding 2.5 million flows; (C3) FlowFPFilter v3.0, a SHAP-guided post-processing filter that reduces false positives by 22.9% while preserving recall; and (C4) a five-protocol robustness evaluation framework that rules out data-leakage artefacts and confirms statistical stability across algorithm variants and random seeds. Evaluated on CIC-IDS2018 and the complete four-part UNSW-NB15 dataset (2.54 M flows; nine attack categories), PCAP-AIDE achieves F1 = 0.9997 and F1 = 0.9919, respectively, surpassing the AdvIDS-2025 baseline by ΔF1 = +0.0729 and +0.0479. FPR on UNSW-NB15 is 0.0144 — within the operational acceptance threshold of <2%.