thanks for the replies guys. Definitely was a sip scanner. Closed ports on the router and no more calls