Update:
Found the issue, calls where incoming from port 5080 (unauthenticated), few months ago we got a list from our SIP provider to whitelist port 1025 to 65535 (purpose "media"). But the protocol was "RTP" and our firewall only had TCP or UDP.
Adjusted our firewall and calls stopped.