@Stevesky Thanks for that, Ah time.netweaver.uk must have been part of the pool.ntp.org.
16:21:55.694377 IP (tos 0x0, ttl 128, id 417, offset 0, flags [none], proto UDP (17), length 76)
mu-so.1236 > fluffykins.positive-internet.com.ntp: NTPv4, length 48
Client, Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 4 (16s), precision -14
Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
Reference Timestamp: 0.000000000
Originator Timestamp: 0.000000000
Receive Timestamp: 0.000000000
Transmit Timestamp: 305.522632087 (2036/02/07 06:33:21)
Originator - Receive Timestamp: 0.000000000
Originator - Transmit Timestamp: 305.522632087 (2036/02/07 06:33:21)
16:21:55.702615 IP (tos 0x0, ttl 56, id 49808, offset 0, flags [none], proto UDP (17), length 76)
fluffykins.positive-internet.com.ntp > mu-so.1236: NTPv4, length 48
Server, Leap indicator: (0), Stratum 3 (secondary reference), poll 4 (16s), precision -22
Root Delay: 0.034774, Root dispersion: 0.025894, Reference-ID: ntp1.exa-networks.co.uk
Reference Timestamp: 3839412009.515010766 (2021/08/31 16:20:09)
Originator Timestamp: 305.522632087 (2036/02/07 06:33:21)
Receive Timestamp: 3839412115.695731596 (2021/08/31 16:21:55)
Transmit Timestamp: 3839412115.695782682 (2021/08/31 16:21:55)
Originator - Receive Timestamp: -455555485.826900491
Originator - Transmit Timestamp: -455555485.826849404
A packet capture of DNS has also confirmed.
16:32:37.384813 IP (tos 0x0, ttl 128, id 187, offset 0, flags [none], proto UDP (17), length 60)
mu-so.1234 > pfsense-user.domain: 13330+ A? 0.pool.ntp.org. (32)
16:32:38.228313 IP (tos 0x0, ttl 64, id 50773, offset 0, flags [none], proto UDP (17), length 124)
pfsense-user.domain > mu-so.1234: 13330 4/0/0 0.pool.ntp.org. A 185.208.170.29, 0.pool.ntp.org. A 129.250.35.251, 0.pool.ntp.org. A 109.74.206.120, 0.pool.ntp.org. A 178.62.16.103 (96)
16:32:39.236365 IP (tos 0x0, ttl 128, id 224, offset 0, flags [none], proto UDP (17), length 60)
mu-so.1236 > pfsense-user.domain: 13586+ A? 1.pool.ntp.org. (32)
16:32:39.327181 IP (tos 0x0, ttl 64, id 18942, offset 0, flags [none], proto UDP (17), length 124)
pfsense-user.domain > mu-so.1236: 13586 4/0/0 1.pool.ntp.org. A 193.47.147.20, 1.pool.ntp.org. A 85.199.214.101, 1.pool.ntp.org. A 185.83.169.27, 1.pool.ntp.org. A 139.143.5.30 (96)