I meant 'stuck channels' as in channels in asterisk that haven't hung up. Yes red is kernel in the htop CPU display. Another thought that occurred to me, how is your firewall setup? Do you allow SIP connections from anywhere on the Internet? If so it might be a brute force attempt on your SIP...