I had qvm-service -e --verbose sys-net clockync on
That syncs the system clock to the sys-net every hour on the hour. For the last week or so I had some, unrelated to whonix software, complain “clock-skew” and some was getting knock out.
Yesterday I realized that the hacker was fishing for a Whonix Workstation that was on. It got one even when no user software was on. I had to kill that workstation. Will see if anything else was affected.