On what interface does this spoof get detected? That should give you a clue if it's originating from the inside or the outside. If it's from the outside (the Internet) you can safely ignore it since your firewall is dropping them.