Update: it seems that this has been traced to a single layer1 ntp server.