It's PureVPN.

I'm not 100% sure about any of the ntpd connection requests, they're not predictable in their appearance. Some sessions are very quiet (zero requests), others I get a bunch of incoming connection requests for smbd, and other odd things. I really should start taking notes rather than just deny the connections.

It looks like your VPN provider does not isolate traffic between clients connected to the same server. That is pretty bad, security vise.

That's what I'm thinking. Suffice to say after a bit more poking around today, I no longer use the service.

Leakage from other clients perhaps?

That's my gut feeling, yes.

What server is your NTP Daemon configured to use? pool.ntp.org?

That could just be different pool addresses coming up.