Every minute there is an annoying ranger audit log in our current cluster where anonymous is trying to access the /flow.

The client IP address is the same address as the NiFi node itself so it seems like the server itself is trying to access /flow but can't.
Has anyone seen this before?