Firewall question

Here is a sample entry in my firewall.

Act Time If Source Destination Proto
X16 22:23:03.854551 DMZ 192.168.1.199, port 80 152.163.100.139, port 57527 TCP

(I am using m0n0wall) The DMZ is setup to allow everything except to LAN. These entries come within seconds of each other, usually around a dozen at a time. They are always within a couple ports difference also. First weird thing...where are they coming from? These are none standard ports to IPs I do not know. Second, why are they being blocked? The rules aren't specifying they be blocked? Just a little confused why port 80 going out is being blocked.

Any ideas? This server is running a couple websites with FTP, mail, and DNS for them.

Thanks!