The "Use random ports" seems to have solved the problem. I restricted the SIP servers as an additional barrier. No more ASTERISK calls. Thanks to all for the help in identifying the issues and proposing solutions.

I am currently happy with my HT502 BYOD config, including a 7-10-11 dial plan, NAT keep alive, random ports, and SIP restrictions.