Well, I discovered what it is, it was the Cisco SIP ALG. I never thought to clear the NAT translations after disabling and the Cisco kept pushing SIP traffic through it long after a typical UDP timeout, I presume it just tracks them like TCP sessions.
You have to wonder why router...