Security - Someone Calling my PBX and attempting to make calls through it

My PBX is being called regularly, about 1 call every minute, and are attempting to make calls through. It is currently setup to answer using IVR as it is afterhours. Yesterday they found an option to make attempt to make calls using an external phone. I disabled this for a few hours and this stopped the calls. I then put the phone back in. About 12 hours later the calls are coming in again. I then had to disable the external phone and it stopped.
Any suggestions to stop these types of incoming calls?

What is this “external phone” and is it itself exposed to the internet directly?

The External Phone is a mobile phone. not exported to internet or net work. Our PBX forwards the call if the corresponding IVR option is chosen.

And you have disallowd anonymous and guest sip calls? and have a firewall/IDS in place?

That is a different problem, please identify exactly how you installed FreePBX and how you configured the POTS lines. If you have CallID on the trunks then see if there is a pattern of the callers.