Why SQL Server Service Account connects to the DAC?
I recon that this is port/virus scanner that your security team might be using to find out vulnerabilities e.g. weak passwords. I had the same issue and eventually I figured out that it was the port scanner.

Look into windows event log as well.