Port Attack from SEPM Server

I have one user who is getting a popuo stating that traffic coming from 10.10.10.16 is being bloack for 600 seconds and that a Port Scan attack is logged. The IP address mentioned is the server that SEPM is running on. Why would this be the case? There are other things running on this server, but only one user sees this pop up.