ARD/VNC connection logging? Port 5900 attempts not getting logged

I have a 10.7.5 machine on my home network with the built-in screen sharing turned on. I connect to it from work with the standard Screen Sharing app, so it's a basic VNC connection using the default Apple client/server software on the default port 5900.

These connections show up in /var/log/secure.log like this:

Jan 15 10:16:41 MyServer screensharingd[7630]: Authentication: SUCCEEDED

Jan 15 10:21:35 MyServer screensharingd[7630]: Authentication: FAILED

But when I look at my traffic logs (using PRTG Network Monitor), I see frequent port 5900 connections to that machine that don't correspond with any secure.log entry.

Where might those connection attempts be logged? Is there something other than screensharingd that might be handling port 5900 traffic?

Thanks,

Ian