Normal
I don't know if is the client itself or not. But when this happens to me I go to wire shark and listen on ip. Everytime this happens this is a vpn user. I think it is some kind of exploit i really dont know. Its like the user is just spamming packets to us through the 28960 port. The ip will also change frequently. The only way I think I can fix this is by putting the ip on some kind of firewall whitelist. Im not sure if that is even possible on windows though. Another way would be to get a vpn so that the user can't pinpoint your ip.