Yeah, logging is good when you need it; but there's only so much space on an ER -- as little as 500MB on an ER-X.
Don't recall seeing in your firewalls that you were allowing access to those two specific 172.x addresses. Make sure those servers have "allow" rules before your "drop RFC1918 space" rule.