Yes I have one small data source doing encrypted TCP syslog. It was not causing problems until 9.6.1
This might be the root cause of the bug we're seeing.
Fun Fact I noticed as well: I don't have to activate UDP for it to be enabled in 9.6.x. In short the checkbox does nothing and it is enabled by default.
In version 9.5.1, if they are not explicitely enabled in the setup menu, the logs won't show up in display and enter KiwiSyslog.
Until a new version gets released with fixes, it's gonna be 9.5.1 for me.
Sad state of things honestly for a professionnal product.