After what I’ve seen on the networks I administrate, there are some TP-Link devices that are doing excessive NTP and DNS queries (to the local resolver).
I can’t tell at the moment, if they are asking for au.pool.ntp.org - I could find out in the next few days.
From what I’ve seen I can tell, they are definetily using pool NTP servers. I just can’t tell which pool
The exact model I’ve spotted is a TL-WA860RE WiFi repeater. I don’t have any details to configuration or firmware version since I have no access to these devices.
EDIT: Maybe related to this one?
Could be a new firmware version which brought back the old behaviour?