Ports 61000 to 65096 are used by Linux's "IP Masquerading" NAT feature. Therefore, if you see these as source prots, there is a good chances that the client is going through such a NAT.