I suspect that NTP traffic was the trickle of traffic that traversed my recently decomissioned NAT