torch the interface and you can see what these traffic is that is the source and destination IP , port etc.
when in winbox, right click on the interface , then select torch
as for firewall , default firewall rule is pretty good out of the box.
basically, on input chain, you accept established and related
drop invliad
drop the rest
on forward chain,
accept established and related and make sure the in-interface is your wan interface (or make the dst-ip to be your public ip)
drop invalid
drop everything that is not dst-nated
this is a very good introduction
https://wiki.mikrotik.com/wiki/Manual:S ... our_Router
also, check if socks server is enabled, check proxy and check if there is a user been added and you don't know about. these are the common places hacker would want to change.