Looks like it may possibly be the snapchat app causing all of this
http://mailman.nanog.org/pipermail/nanog/2016-December/089590.html
________________________________________
From: nznog-bounces(a)list.waikato.ac.nz
it's doing 4x as much traffic as compared with a few days back, previously the traffic pattern has been fairly stable.
Any info on the source distribution? Is the delta of sntp queries
originating from what appear to be broadband access networks, or . . . ?
-----------------------------------
Roland Dobbins