On not public server: Host name example.com could not be resolved: Name or service not known

This is not a duplicate (please read carefully)

Digging in mysql logs of a production server I found a few entries with the error above, all pointing to the same host name. Each entry appears ~30 seconds right after mysql starts. There is also no record of the hostname in mysql.user table

I would not be surprised if mysql was exposed to public internet but it is not. The port is blocked by lfd/iptables and explicitly allowed for a few public/private IP addresses.

MySQL's skip_name_resolve is not enabled, since I need hostname resolution for a few VPN servers.

Where these entries may be coming from? The server is WHM/CPanel, MySQL 5.6.21