Got reply about the packets. The packet size depends on different firmware version, which makes sense to me. There are two types of heartbeat happening every few seconds for 70 bytes or less. (I am obfuscating some details here to protect their IP). This explains for 91.132.137.155 and 66.23.205.130.
For 23.83.132.78, both TUTK and I think there was some streaming activities happened. I hope @gelly035-happy can give out the network capture starting/ending time + device MAC so we can check for logs. Not that we don’t trust you but we want to see if it matches the logs. I don’t know if that is still possible since I believe the devices were returned. Without that info we can’t draw a firm conclusion what happened there.