With no firewall rule to open TCP port 25 dnscheck.net reports a timeout when connecting on port 25. If I add a firewall rule to open TCP port 25 checkdns.net reports that the connection was refused.

Yes, UDP port scanning isn't great, but it's just weird that so many machines are responding with that UDP port active, no corespoding TCP port active, and through repeated scannings.