One more little tidbit of information. I can replicate the spike by viewing the Connectivity > Firewall page(s).