You could try to use 'netstat' and see where these connections are coming from.
If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.
As intended by lmce I have the core as the router. As mentioned before, unplugging the internet cable stopped the ringing. I don't see anything special on netstat. what should I look for?