Verified it's not coming directly from a certain computer on the network. What could be wanting to spoof the WAN besides the probable reply of malware? I can provide logs but not easy at the moment.
Simple time warner modem, belkin N150, couple clients