No, neither. The setup is fairly vanilla, except OVPN server is running.
I have 2 Apple Time Capsules connected by Ethernet, set up as APs. Not sure if that is relevant.
UPnP enabled? Do you use any peer-to-peer applications like Dropbox/Syncthing?
Basically what we’ve seen is these applications, being decentralized, have to discover other nodes and they end up discovering and peering with itself via the port opened through UPnP or port forward.