It is also true that there may be circumstances where one very busy server may try connecting to another. Hypothetically speaking, a machine acting as a proxy server for a network that supports thousands of users could generate enough traffic to constitute a SYN flood. This is a case where the load is simply so high that it consitutes the upper end of the average. Since machines are designed and built with load as a determining factor, a high load will inheritatnly consume enough system resources to become a cause of concern. Note that concern does not equate to alarm, at least not for our purposes.
Concern simply means that the situation needs to paid attention and kept track of.
Alarm consitutes the need to take some corrective action. That's the background of the SYN flood problem. In the case of the non-malicious occurance, a simple measurement of data traffic to determine if the load is indeed high enough to cause problems. If not, the message can be safely relegated to the system logs. If the traffic rate is high enough to cause problems, then having a chat with the sysadmin's of the source machine may be in order.