[Observium] IPSEC tunnel count continuously increments

I've built a DMVPN test network with one hub and one spoke and upon monitoring them, I notice the graph for IPSEC Active Tunnels (/graphs/type=device_cipsec_flow_tunnels) increments by one every hour - only on the spoke router, not on the hub.

So I'm wondering where Observium is grabbing that piece of data from? Which SNMP OID?

If I do a "show crypto eli" on the spoke, I have 2 active sessions (Observium now reports 66), and 12 on the hub (Observium reports 5).

Any ideas?

Thanks!