Just an idea, but your Netgear router, does it have "Apparmor" or whatever they call it these days enabled? I remember reading recently a similar case where someone thought that there was an attack coming from their routers IP on one of their IOT devices, but the router was just a netgear with some built in network antivirus BS that tries to scan their LAN network looking for vulnerabilities (trying common logins, etc).