I changed the NTP server from DNS name to IP address, and now ZD1200 uses only the single specified NTP server. It no longer queries random NTP servers.
Changed back to DNS name and waiting to see what happens - from packet capture it looks like ZD1200 queries the NTP server every 1 hour so it should not take long.
If the random (pool.ntp.org?) NTP servers are no longer queried, then I would guess that some time during update of ZD1200 the NTP setting was "deactivated" somehow. This ZD1200 has been updated numerous times.