We have been paged 3 times for this and it resolves before I can see what's up.
At the moment I see the following serious users:
root@tools-bastion-03:~# host 10.68.20.221 221.20.68.10.in-addr.arpa domain name pointer mwoffliner4.mwoffliner.eqiad.wmflabs. root@tools-bastion-03:~# host 10.68.16.103 103.16.68.10.in-addr.arpa domain name pointer maps-tiles3.maps.eqiad.wmflabs. root@tools-bastion-03:~# host 10.68.16.70 70.16.68.10.in-addr.arpa domain name pointer maps-wma1.maps.eqiad.wmflabs.
But none of them are doing anything abusive afaict.