Port exhaustion and random process - sockets

Question

I am investigating a network problem on a Windows Server 2016.
Around once a week, all outgoing ports are used up, which means that various network components no longer function properly. If this happens you will find these warnings in the Windows Eventlog:
TCP / IP warning: 4231
"A request to allocate an ephemeral port number from the global TCP port space has failed due to all such ports being in use".
TCP / IP warning: 4227
"TCP / IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint. This error typically occurs when outgoing connections are opened and closed at a high rate, causing all available local ports to be used and forcing TCP / IP to reuse a local port for an outgoing connection. To minimize the risk of data corruption, the TCP / IP standard requires a minimum time period to elapse between successive connections from a given local endpoint to a given remote endpoint ".
That looked like a typical handle / socket leak for me and I tried to find the process with "netstat -anobq" to which the connections can be assigned.
This is a very short list of connections in WAIT state:
  ...
  TCP 192.168.24.40:49814 192.168.24.40:49661 WAIT 0
  TCP 192.168.24.40:49833 192.168.24.10:5432 WAIT 0
  TCP 192.168.24.40:49880 192.168.24.40:49670 WAIT 0
  TCP 192.168.24.40:50167 192.168.24.40:49661 WAIT 0
  TCP 192.168.24.40:50185 192.168.24.10:5432 WAIT 0
  TCP 192.168.24.40:50236 192.168.24.40:49670 WAIT 0
  TCP 192.168.24.40:50713 192.168.24.40:49661 WAIT 0
  TCP 192.168.24.40:50718 192.168.24.10:5432 WAIT 0
  TCP 192.168.24.40:50725 192.168.24.40:49670 WAIT 0
  TCP 192.168.24.40:50798 192.168.24.40:49661 WAIT 0
  TCP 192.168.24.40:50837 192.168.24.10:5432 WAIT 0
  TCP 192.168.24.40:50887 192.168.24.40:49670 WAIT 0
  TCP 192.168.24.40:51308 192.168.24.40:49661 WAIT 0
  TCP 192.168.24.40:51336 192.168.24.10:5432 WAIT 0
  TCP 192.168.24.40:51360 192.168.24.40:49661 WAIT 0
  TCP 192.168.24.40:51380 192.168.24.10:5432 WAIT 0
  TCP 192.168.24.40:51427 192.168.24.40:49670 WAIT 0
  TCP 192.168.24.40:51487 192.168.24.40:49670 WAIT 0
 [Explorer.exe]
There were a huge list (> 1000) of connections in WAIT state. In this example the process seems to be explorer.exe but if I run the same command a few minutes later the open process is a different one. I captured Firefox.exe, SSHd, Windows Telemetry Service and many other processes with a huge list of wait connections.
The second strange thing is that 90% of these connections point to 192.168.24.10:5432. A Postgres DB runs on 5432 on this server. But FireFox, Explorer.exe and more than 10 other processes do not access this DB.
It looks like netstat is wrong, and the connections belong to another process. Is this even possible?
Windows Defender is running on this server and additionaly I did a scan with Panda Antivirus. The server seems to be clean.
I could lower the wait timeout to close them earlier or increase the number of outgoing connections (currently ~ 16000). But I think that will only move the problem for a few days.
Do you guys have any advice on what checking next?