Do you access the MCU from multiple locations via http(s) / api access?
MAybe you could debug what is hammering on the http ports (monitor port with wireshark, debugging on the mcu, ..)
If you can rule out that its not something unwanted and its just by using the Codian Director
and that product still exists under cisco and you have a valid service contract for the software and
the MCU and you do not get a better answer here, think about escalating this case as a service
request to Cisco TAC.
Please remember to rate helpful responses and identify helpful or correct answers.