In the log there are entries with “out” in the direction column. What this means is that these aren’t incoming connections (these would have “in” there) and therefore it couldn’t ever be a port scan.

Cheers, Lukáš.