What is the cause of the demand spikes?

Server operators
8

systemd-timesyncd can create bursts of NTP requests.
FortiGate firewalls has created NTP bursts for several years.

Packet captures may help track down the sources.

3 Likes