Nothing is exposed directly to the internet, but I had some development services that were accessible on my private network.

I do use Dropbox, but the odd part was it seemingly IPsec traffic.

I really should have grabbed a pcap when it was occurring. I only have a screenshot of tcpdump which is not very useful.