It appears at some point my ER605 got caught in an adopting / provisioning loop. Everything kept working so I didnt notice an issue until the controller docker crashed and restarted it.

Every few minutes there is a log entry that the gateway disconnected.  Prior to this were entries that it 'detected TCP SYN-and-FIN packets attack and dropped 1 packets.' Those show the MAC address instead of the T5_router name.

Restarted and failing that rebuilt the controller docker container.

Im planning some downtime to reboot the gateway and factory reset if necessary. Ive found mention of this issue on ER605 v1 and v2 and downgrading the firmware or using a beta firmware. But I appear to be on the latest firmware for the V1.