I have seen a lot of Toshiba wireshark captures, and the amount of data on port 2944 is very minor, and and typically used when the phone first registers. The data sent is no more then about 700 Bytes total. Even with a larger (50+) phone deployment I the data traffic this port isn't much more then a few KB when rebooting all the phones at the same time. Once registered the phones barely send any more data using this port.

Port 2944 doesn't have anything to due with the actual VoIP audio, so G.711 and G.729A won't change the amount of data it uses.

I have to believe that something doesn't add up at all with this firewall report. Can you do a pcap capture of the data coming from the phones? I would be extremely surprised if this port uses more then a few KB after a phone reboot.