Database Mirroring protocol TCP ports used. One default, one dynamic?
When an application establishes a TCP connection, it specifies a port for the inbound (receive) port, and uses a (somewhat) randomly selected port for outbound (source, or send).  The inbound port for AG replication is 5022 by default, so all replication traffic is sent TO port 5022.  Accordingly, you see the network reads occurring on port 5022, as SQL Server is listening on port 5022 and reading packets that are sent to that port.

The outbound port, which is selected randomly (more or less), is the port it is sent FROM.  Accordingly, you see the writes associated with the random port (63420 in your example), as SQL Server is writing data to this port to be sent on the connection. 

See How are source ports determined... for more