>> Kiwi Secure Tunnel Server, and in addition to the user defined TCP ports, the application also listens on apparently random high UDP ports.
You lost me there. All of the ports in the Kiwi Secure Tunnel system are configurable. In the Kiwi Secure Tunnel client (the software that receives Syslog messages and forwards them over an SSH link) you configure up to 10 listening ports in the "Properties" dialog. These listen for Syslog traffic, of course, but can be either UDP or TCP. In the Kiwi Secure Tunnel server (the software that takes Kiwi Secure Tunnel client input and emits Syslog traffic) you only configure one listening port, a TCP port that listens for incoming SSH connections.
I copied in a couple of screenshots with default settings below.
Do you have some "netstat -an" or "netstat -anb" output you could share showing additionally bound high UDP ports?