Plain L2TP... when I googled today to find the port number, I noticed that L2TP is not encrypted on its own and I should use L2TP/IPsec... I had not realized that... oops!... gonna look into switching that!
That's perfect, a full stealth result.
That's one possible cause for the NVR behaving oddly now eliminated - it's not accessible from the internet such that any vulnerabilities could have been exploited.