You are right: port 5065/udp traffic are CA beacon messages, which are sent every 15 seconds (unless configured otherwise).

What is the server IP address (-sip <addr>) of your Gateway? If you don't configure a CA server to bind to an explicit IP, it will bind to all available network interfaces, including the one that the Gateway uses to connect to its clients (the machine called "cagw" in your case). Obviously, the CA server will also send beacons on all interfaces it binds to.

I.e., not setting the server IP of a Gateway would explain the behavior you are seeing.

Cheers,

~Ralph