I wanted to get a second opinion.
I have an internal address of X. It appears to be stateful from the syslogs.
I have an external address of Y. It too appears to be stateful.
There are X connections to Y on a port. This seems normal.
There are Y connections to X on the same port. Is this normal if you don't allow inbound access with stateful connections?
Here is the sanitized syslog message
Built outbound TCP connection 5425442354 for faddr Y/some port gaddr X/some port laddr X/some port