The two I most often see in Ubuntu's dmesg are:

audit - appears to be some sort of AppArmor logging?

br[] - bridge interface docker uses consistently rebuilds itself? May be related to docker compose networking.

Yeah docker does a ton of network stuff when you start/stop containers, depending on your configuration. It's extra fun because it can drop existing connections when that happens.

Had a process quietly in a crash loop for a solid month on my workstation until I figured out what was causing my random network outages.