Sounds like it's blocking things, i.e., doing its job.
On a more serious note, here's some possible reasons:
- if you have a torrent program up that supports DHT, and it's running in the system tray or the background, it's in constant intermittent communication with other systems.
- You may have other programs running in the background that do something similar, like the Akamai NetSession service.
- if you recently participated in a torrent swarm, then quit, your IP may remain in the tracker for a while until it ages out, thus other peers may still be trying to initiate exchange sessions with you for a time thereafter.
- The Windows IP Helper service causes some weird stuff. I've never bothered to track it down intensively but when I disabled it my router's
iftoplooked a lot cleaner. - You have viruses or malware doing stuff
- Port scanning and scanning IP ranges is a common activity. Any IP is likely to be the target of seemingly random traffic.
Of course the only way to know for sure is to track down each request and investigate it fully, but that's impossible.