TCP wrappers uses the /etc/hosts.deny file to control access. It will produce something in the system log when a connection was blocked.

It doesn't just go activate itself so I'd bet more on the random DHCP fluff theory.