I saw these 2 (and some more) entries in the firewall logs on the "front page".
As i read the log they originate/come over the LAN, but should come from the interface "OVPNPUBLICIPV4" since only from this interface the port it gets redirect to, are open (port forwarded).