I just noticed in firewall logs that mikrotik tries to ping random devices from public wifi network. I can't say what exactly is correlation between public wifi network and other networks. The only thing I can think of is that it's the only network that has actively used DHCP server (on that mikrotik) while all other networks use static IP addresses (or have DHCP server but devices use mostly static IPs anyways)
It makes me a bit concerned if it's not compromised... is it normal for ROS to sometimes just ping devies for no particular reason? I don't have any scripts that could cause such behavior. http and ssh are only opened to management network (on firewall level). Winbox is disabled. Source addresses are checked against interfaces on firewall (so it really is only opened to management network, there's no way to spoof IP). It's CCR1009 on ROS 6.43.2 (current branch)