Not sure how to interpret traffic pattern on my router. DHT?

I configured tribler as per docs:
7759 tcp/udp
7760 tcp/udp
7000 tcp for torrent
These ports are forwarded to my tribler instance.

What I would expect is to see connections on these ports only (originating and destined to these ports on my public ip)

However, when I inspect the trafic on my router, only a handful of requests go to these ports (7759 specifically)

The rest seem to go to random UDP ports, and I am not sure how why this is occurring.

Here’s some logs:
||WAN||…:59|192.42.116.244:39873|:44019|udp|Default deny / state violation rule|
||WAN||…:09|192.42.116.244:38732|:8090|udp|Default deny / state violation rule||
||WAN||…:09|192.42.116.244:32434|:27852|udp|Default deny / state violation rule||
||WAN||…:08|192.42.116.244:34234|:8090|udp|Default deny / state violation rule||
||WAN||…:08|192.42.116.244:35234|:8090|udp|Default deny / state violation rule||
||WAN||…:08|192.42.116.244:31342|:28033|udp|Default deny / state violation rule||
||WAN||…:07|192.42.116.244:32143|:33384|udp|Default deny / state violation rule||
||WAN||…:07|192.42.116.244:39383|:8090|udp|Default deny / state violation rule||

The nodes that try to send packets to these ports are part of ipv8 overlay, so I understand who they are. This is verified through /ipv8/overlays API endpoint.

Maybe I am misunderstanding some concepts, or have some misconfiguration on my end?