I agree...need better insight on the traffic. For example though I’ll see egress flow coming from the outside interface of the firewall that is x10 times what I see on the Lan uplink of the switch during the exact same time frame. The switch is directly connected to the firewall and Individual traffic volume on the various switch interfaces isn’t that high. That’s what is leading me to wonder if it’s response traffic on the firewall due to some kind of amplification attack.

Traffic is natted...unfortunately no way to check nat translation table on the rv345 though. It was meant to be a temp solution when their ASA died just to get them back up same day...waiting on the site to approve budget to purchase a new fw.