This has been resolved. Nothing to see in here.
Taking a look at the firewall log I see two entries:
20150626 9:39.14am Windows Operating System Blocked In ARP x.y.52.158 x.y.52.158
20150626 9:39.13am Windows Operating System Blocked In ARP x.y.79.65 x.y.79.65
I have anti-ARP spoofing enabled (hence the Blocked above). The part I don’t get is the IP addresses. They’re not part of my network. At the moment I have a DSL modem at x.y.52.152 and a XP box at 192.168.2.12.
Was this an attempt to trash my ARP cache (which CIS caught)?