I don’t think it is comodo as that doesn’t initiate the concurrent connections, it would just be monitoring/recording them. I think because there is such a big deal made about port 120 that it has to be something to do with that.

I assume there are no firewall logs to indicate exactly what is using that port ?