RRD shows half the packets as in-block?

[namezero111111]

Dear community, I have a question about an RRD graph on a 2.0RC1 system.

The system runs only an IPSec off the WAN interface to another PFSense box, and transports about 45mbit/s.
We just set this up yesterday, and the RRD graph for the WAN interface shows (exactly?) half the in traffic as blocked (See image1).
Looking at the average (3.4k pass vs. 3.39k block) it seems to be exactly half.

Looking at the firewall logs, nothing should cause anything like this, since only a few DHCP request every few seconds are blocked, which shouldn't make for half the traffic.
(Image 2)

Does anyone have any idea as to what causes this?
Or is this just a strange problem of how RRD interprets traffic for some reason?

Thanks for your help!