Please have a look into pihole.log not pihole-FTL.log as the former contains details about the queries leading to this.
Pi-hole only tries once and then tries again once an hour. The queries are likely coming from some other application on the system, however, with a log snippet from pihole.log we may know more.
REFUSED is interesting, do you use conditional forwarding?