Tailscale Premium: Unexpected exit-node egress

Original query, unchanged.

let baseline = 7d;
let recent = 1h;
let recentEgress =
    Tailscale_Network_CL
    | where TimeGenerated > ago(recent)
    | where HasExitTraffic
    | mv-expand t = ExitTraffic
    | extend Src = tostring(t.src), ExitDst = tostring(t.dst), Bytes = tolong(t.txBytes) + tolong(t.rxBytes)
    | summarize FirstSeen = min(TimeGenerated), TotalBytes = sum(Bytes) by NodeId, SrcNodeName, SrcUser, SrcOs, Src, ExitDst;
let baselineEgress =
    Tailscale_Network_CL
    | where TimeGenerated between (ago(baseline + recent) .. ago(recent))
    | where HasExitTraffic
    | mv-expand t = ExitTraffic
    | extend Src = tostring(t.src), ExitDst = tostring(t.dst)
    | distinct NodeId, Src, ExitDst;
recentEgress
| join kind=leftanti baselineEgress on NodeId, Src, ExitDst
| extend TotalMB = round(TotalBytes / 1024.0 / 1024.0, 2)