Well you don't actually have to sniff on the client... Sniffing on lan side and wan side should help you find the problem... You really want to capture a few full stream or conversations.
So you see the syn and syn,ack of the start all the data moving ack, ack ack, etc.. Then the close with fin,ack from both sides and acks..
its quite possible the echo send fin,ack - but amazon never sends back ack to that - so it causes a burst of noise like.. I don't log default block rule.. Unless I am troubleshooting something... I have 3 echo devices.. So I could turn on logging to see if notice any such burst of FA and RA being logged.
Do you have pfsense set to reset states on loss of wan? That could cause lots of bursts of this on little blip on your wan connection..
system, advanced, misc
killstates.png