Responsive Firewall Blocking IPs after Extensions have Registered

I have a curious situation. I have a user who’s on their home network using Linphone to try to make calls with our FreePBX server (which is on a Vultr instance). I can confirm 100% that the extension (pjsip) credentials and sip server settings are correct with Linphone.

This is the behavior I’m seeting. The extension will regsiter, and the user will be able to make calls. A few minutes later, the user’s IP address shows up on the rate limited list in the Responsive Firewall Status, and then is blocked by the responsive firewall.

Are there any logs that list dropped packets and a possible explanation as to why they’re dropped? What puzzles me is the fact that the extension registers and then is blocked, rather than the extension trying multiple times to register, failing, then is blocked.