After pressing post on the above I closed the computer used to log on the server vis VPN and went to bed. Next day (27th) the problem has returned. Server Terminal app was left open on the server and when logging I found these strange lines on the terminal screen that appears to have been created by about 1 minute (26th) after I made the above post and close VPN connection.
=> Successfully stopped `httpd` (label: homebrew.mxcl.httpd)
==> Successfully started `httpd` (label: homebrew.mxcl.httpd)
lowerlevel@70-89-220-117-clean-air-engineering-il ~ %
[Restored Oct 27, 2024 at 5:48:45 PM]
Last login: Sun Oct 27 17:48:45 on ttys000
You have new mail.
lowerlevel@70-89-220-117-clean-air-engineering-il ~ % >....
2024-10-26 22:48:41.548060 <Notice>: Last log repeated 1 times
2024-10-26 22:48:41.547173 (gui/501 [100003]) <Warning>: denied lookup: name = com.apple.contactsd.persistence, requestor = searchpartyuser[19692], error = 159: Sandbox restriction
2024-10-26 22:48:42.000201 <Notice>: Last log repeated 1 times
2024-10-26 22:48:42.000151 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07) <Notice>: internal event: WILL_SPAWN, code = 0
2024-10-26 22:48:42.000184 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07) <Notice>: service state: spawn scheduled
2024-10-26 22:48:42.000189 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07) <Notice>: service state: spawning
2024-10-26 22:48:42.000272 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07) <Notice>: launching: ipc (socket)
2024-10-26 22:48:42.001722 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: xpcproxy spawned with pid 93499
2024-10-26 22:48:42.001762 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: internal event: SPAWNED, code = 0
2024-10-26 22:48:42.001769 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: service state: xpcproxy
2024-10-26 22:48:42.001794 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: internal event: SOURCE_ATTACH, code = 0
2024-10-26 22:48:42.013150 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: service state: running
2024-10-26 22:48:42.013172 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: internal event: INIT, code = 0
2024-10-26 22:48:42.013207 (system/com.openssh.sshd.6A33D7FA-D690-4228-9D58-38BB7C55BD07 [93499]) <Notice>: Successfully spawned sshd-keygen-wrapper[93499] because ipc (socket)
2024-10-26 22:48:42.017663 (pid/93499 [sshd-keygen-wra]) <Notice>: uncorking exec source upfront
2024-10-26 22:48:42.017685 (pid/93499 [sshd-keygen-wra]) <Notice>: created
2024-10-26 22:48:42.021595 (pid/93499 [sshd-keygen-wra]) <Notice>: domain exec event
2024-10-26 22:48:42.021606 (pid/93499 [sshd-keygen-wra]) <Notice>: shutting down
2024-10-26 22:48:42.021616 (pid/93499 [sshd-keygen-wra]) <Notice>: cleaning up
2024-10-26 22:48:42.021623 (system) <Notice>: removing child:
Note that the Server Firewall has been on for months. The server is owned by a corporation and has 3rd party protection software installe and related user named Ntiva which is an admin User.
I will check with corporate IT tomorrow to see if Ntiva has messed with the server.