External firewall logs show blocked connection from < node IP >:< big port >. The current cluster uses calico networking.
How do I detect which pod trying to connect?
This would usually be pretty hard to work out, you would have to check the NAT table on the node where the packets exited to the public internet.