I didn't look at all of them, but I've been tracing some of the IPs that have been blocked. Each one I've traced goes back to *.in-addr.arp. Even more interesting is that some of these connections get blocked, even though they're incoming on port 443, which allows traffic from anywhere!
Any ideas what in-addr.arp is, and why the firewall would block it even on allowed ports? I remember seeing this somewhere in the Unbound config, but the IP isn't the same, and I didn't set up any of the "local zones" in there.