Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80:

# ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l
935

Netstat shows a similar number:

# netstat -n | grep $OFFICEIP | grep :80 | wc -l
922

(Although interestingly the netstat number periodically changes, either going up or down a bit.)

We simply cannot find where these connections are coming from. Our office router doesn't show them in its tables, and doing a tcpdump (tcpdump -ieth1 -qnnvvSXs 1500 port 80) on the remote host shows zero traffic on that port at all, let alone from our office ip.

In addition, conntrack doesn't show the connections as existing either:

# conntrack -L | grep $OFFICEIP | grep 80
conntrack v0.9.13 (conntrack-tools): 38025 flow entries have been shown.

This is happening on a box running CentOS 6, kernel version 2.6.32-431.29.2.el6.x86_64. If anyone has any ideas as to where these discrepancies are coming from it would be greatly appreciated.