MongoDB Atlas - Unknown Connections spikes from private IPs

Question

I have a MongoDB cluster running on Atlas. We connect each client to MongoDB by passing an appName with that we know who connects to the cluster and we can identify them.

At some points, we get a huge connection spike of unknown connections and we can't identify them.

If an alert happens we identify the unknown connections with this script:

  const currentActivities = await db.admin().command({ currentOp: 1, $all: 1 });
  const activeConnections: Record<string, number> =
    currentActivities.inprog.reduce(
      (acc: Record<string, number>, curr: Record<string, number>) => {
        const appName = curr.appName ? curr.appName : 'Unknown';
        acc[appName] = (acc[appName] || 0) + 1;
        acc['TOTAL_CONNECTION_COUNT']++;
        return acc;
      },
      { TOTAL_CONNECTION_COUNT: 0 }
    );

I tried analyzing the logs and I see a large number of connections from private IPs. These private IPs have (most of the time) an app name set. For example, they are MongoDB CPS Module.

It is not super straightforward to analyze the logs so I am not sure which IPs the UNKNOWN connections are. I only count the connections by IP.

Did anybody have a similar problem and some suggestions on how to tackle that?

Thank you 👋🏽

Sandro