i see that when my security team runs Nessus scanning. Look at the IP addresses, see if they resolve to their scanners or to something else.

You can use netstat and grep to filter out ESTABLISHED connections using port 445 on each node. You can look at the Foreign Address column to see what IPs are connected. This should let you know narrow down if there is one specific client or group of clients causing excess connections (such as a scanner as dynamox suggests).

If it is one fs version  8.0.0.X

isi zone list -v

isi_for_array 'isi_run -z isi_classic smb file list'

hope this helps