Those are HTTPS requests to sse[0-9]-smartlock.nuki.io, all in the IONOS Cloud.
And ICMP unreachable in response to the SYN will lead to a timeout so it takes a few retries before Nuki ultimately times out and disconnects from the Wifi.
When a TCP RST is returned, Nuki disconnects from the Wifi within a few milliseconds.
I did not try to respond with my own HTTPS Server. I’m not really interested in workarounds on my site, because I consider that this is something that is either a core design principle, or the product is not what I’m looking for at all.
I have returned the 3.0 Pro at this point and will use a normal 3.0 with the ESP32 integration, which as far as I can tell is really well made.
Then I have a solution that actually fulfills my requirements without Cloud enforcement and I have about 100€ left to spend on nice things.