Could this be related to the ntp/time sync peculiarities in relays?

http://www.cs.bu.edu/~goldbe/NTPattack.html

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp

Robert