Ok, you have BRI with DID. I can't help much since you use CCM. But if you do "debug isdn q931" and "term mon" you can check if these calls are coming from outside, and from/to which numbers. You can leave the command on all the time if you want.
We also just deployed a 2851 router to our remote location. The setup includes a frame relay circuit with ISDN as backup. I ran into a similar issue where there was calls iniating by the router. Try back revving your IOS to 12.4.3e, this took care of the issue for us.
Are you getting this error “Installer User Interface Mode Not Supported. The installer cannot run in this UI mode. To specify the interface mode, use the -i command-line option, followed by the UI mode identifier. The value UI mode identifiers...
The below trick might come handy when you have to add a new node to a cluster but you don't have or is unsure of the security password for the publisher. This procedure has been around for ages.
1) Login into the CLI of the Publisher.