I see traffic from my PA-firewall sending out traffic on port tcp/3978. The specific port is used for communication between Panorama and managed firewalls. I don't have any Panorama server setup on my firewall. Why does it still send traffic on that port and how can I disable it?
Are you using cortex data lake (CDL)? That uses that port as well.
Are the connections to the same IP and can you identify it?