A 2h capture on the blocked traffic on the management routers (https://logstash.wikimedia.org/app/dashboards#/view/69b9fbe0-3c1b-11e8-90f7-4958fd3a62b4) shows that those 5 hosts' IPMI are trying to talk Netbios (port 137) to 10.0.1.1, 10.18.128.15 and 10.18.128.16
10.65.5.18 - ms-be1059.mgmt.eqiad.wmnet.
10.65.5.76 - cloudvirt1019.mgmt.eqiad.wmnet.
10.65.1.134 - db1140.mgmt.eqiad.wmnet.
10.193.2.207 - db2100.mgmt.codfw.wmnet.
10.65.1.133 - db1139.mgmt.eqiad.wmnet.
Not sure if they're old hosts or some steps in their configuration got missed, but it would be safer to disable it.