To add on to what Rob said.
I also considered you may be simply seeing traffic reaching the inbound
side of your tunl0 interface.
This is normal, and is general Internet "white noise" from bots,
misconfigured software, viruses, etc. Proper routing and firewalling
will ensure that this unwanted traffic is not inputed/forwarded.
- KB3VWG