We have a similar configuration here. We get the same message logged occasionally. I have found at least one situation that will generate this message: an SOA query for a name on the internal network.