-> Just in case, do you know of any software that may try connect to local Bitcoin full node automatically? Some wallet (such as Ginger and Wasabi wallet) may do that automatically.
Actually I don't. I haven't connected a wallet yet. One of the incoming connection shows up as "70016/dsn.kastel.kit.edu/bitcoin:28.0.0/" which seems to be some school...
By default, Bitcoin Core accept incoming connection. I remember that website/university do some research and share data about Bitcoin, so i doubt it's malicious node. Although i believe that kind of connection should be categorized as either "ipv4" or "ipv6".
-> 1. In this case, "npr" stands for "not publicly routable"
Could that be a connection under i2p network by any chance?
Most likely no.
1. AFAIK all I2P connection would show address with ".i2p" at the end.
2. I2P should be showed under "i2p" rather than "npr".
Is that something I should worry about? As anyone I guess, I am concerned with privacy and security (not maniac but not laxist either).
IMO, no.