Well it looks as though the connections displayed in the UI are legitimate!
It seems as though a large number of clients (from different IPs assuming that you didn’t randomise the last 3 bits of the foreign address) are connecting to the node, specifically via port 11210 which is the data access port.
The issue of the number of connections constantly increasing might not be a server-side issue (your original value of 70 could be normal considering all of the inter-node connections), but rather a client-side one.
What SDK do you use for your clients?
Would it be possible for you to share your connection + data access code for Couchbase, it may be that you are unexpectedly recreating connections.
Perhaps a little more info about your application setup would be useful here too!