As alluded to by earlier posters this problem was actually hacking attempts.  Although they didn't show up in the logs, I actually had to do a packet capture on the firewall, and it showed a flood of register attempts.  I  I blocked everything on port 5060 except for my SIP providers, and so far problem solved.  

Hope this helps someone else.

--

Babstar