Servers sync their clocks over port 123/UDP using NTP, on Linux usually with chronyd or systemd-timesyncd. A drift of a few minutes breaks TLS validation, Kerberos/Active Directory and TOTP 2FA.
A normal server only needs outbound UDP 123. Open it inbound only if the host intentionally serves time to others – old ntpd versions with monlist were heavily abused for amplification attacks.
Typical: VMs with wrong time after a snapshot restore, or a firewall blocking outbound UDP 123 so chronyc sources only shows ?.
Check
chronyc sources -v