In my experience, this is usually due to "spam" calls from things like SIP-Vicous etc. These are scripts that scan public IP addresses for open port 5060 (SIP) and attempt to commit toll fraud.
Check call history and you will likely see several calls with a source address of "100@1.1.1.1", "200@1.1.1.1", "cisco", or random public IP addresses. The will likely have international destination addresses. The goal of the attacker is that the SIP gateway port 5060 that it has located is connected to the PSTN and will allow these types of calls to succeed.
The reason your license limit is getting hit is that these attacks happen very quickly with several dial strings and often from multiple sources, and while the VCS is searching for a match to the destination dial string, a call license is consumed.
My first suggestion is to implement a CPL (Call Policy List), and also well as review your search rule and registration authentication settings. The approach really depends on your environment, as certain settings can keep legitimate users from making calls if not implemented properly. However you can build a open and basic CPL based on blocking the current "spam" calls taking place and go from there.
You can also require that call searches are only allowed from authenticated devices (if authentication is in use strictly), and also create search rules that quickly match unknown and "spam" sources and destinations that route the cals to nowhere and fail them.
I for one prefer using CPL's however they can be a pain to maintain as as soon as an attacker changes their source from "200@1.1.1.1" to "300@2.2.2.2" another rule will need to be added. In my experience however, this does not happen often enough to be a concern.
If you need help building a CPL please share your search history and I can help out.
