I don’t know that we can compare wireguard to nostrability. My best guess is sherlock was pulling and scanning thousands of events from live relays, and this raised some ML flag. No response yet...