You need to disable direct SIP calls, this sounds something SIPviscious initiating fake calls. I believe you can set the Grandstream to “accept from SIP proxy/server only” in the phone SIP security settings so that these calls don’t get passed through.
You can also restrict 5060 to only IPs you’d expect on your firewall.
https://www.sipcapture.org/