Since the firewall logs total packet length, these things probably carry a 20 byte payload. The packets do not seem to be crafted since they all come in on fairly sequential source ports but they come in very fast. I did notice that someone else reported activity on port 98 also. At that time, there was a theory that this is a potentially effective denial of service attack. Martin provides a link to refresh our memories.
Any help is appreciated.
First detect is a couple of port 21 scans, came from Suwon Information Industrial High School in Korea. I allow authenticated FTP, but they did not respond to syn-ack replies so this looks like they are just trying to discover FTP servers. Nice to know that High school kids have similar interests world wide. With the second detect I have seen this pattern a few times in the past couple of weeks. Note that the registered address and the RFC1918 address arrive together leading me to believe they are from the same source.