Sorry for the delay in responding.I am not using SSH port forwarding. I don't have any pattern. If there is any pattern at all it would seem to be the amount of time an RDP session is active. I'll keep a closer eye on that to see if there is a specific time.
Thanks for the quick response.
Brian