Sounds like a case for
http://www.ntlworld.com/netreport/ - unless you do, or have used filesharing, and they are polling for a fileshare port that you don't currently have operating.
As above, are they source or destination ports - I don't recognize the pattern.