I have a RV320 running 1.2.1.14 every so often I see the following in the log;
May 16 14:52:33 2016 routerxxxx ALLOW UDP xxx.xxx.xxx.xxx:500 -> yyy.yyy.yyy.yyy:500 on eth1
xxx.xxx.xxx.xxx = foreign internet IP
yyy.yyy.yyy.yyy = my WAN IP
As far as we know we have not opened anything up to "ALLOW" access, Firewall should deny all from WAN.