TCP connections referencing port 80 at your web servers and a high-numbered port on a public IP address sound like TCP connections from clients to the web servers.
How are you establishing that the initiator of these connections is your web servers? Are you seeing TCP SYN's coming from the web servers' port 80?
I suspect your firewall device is somehow "losing track" of the state of connections periodically and, since the only way to determine the initiator of a TCP connection is by observing the initial handshake, the firewall cannot reliably be expected to report on the "direction" of these connections.
Can you tell us more about the firewall and, perhaps, provide some sanitized log data from it?
It certainly is within the realm of possibility that you've been compromised by an attacker who is attempting to communicate with the Internet in a manner that might disguise their traffic flow as HTTP responses, but Occam's Razor says that it's actually response traffic that is being miscategorized by your firewall. Correlating the traffic flows to your web server logs would certainly help discount the theory that they are actually connections being initiated from the web servers.
Looks like you're using a Fortigate firewall. I haven't had the pleasure of working with one of these before, but I can speak about this generally.
It looks like this is a stateful inspection firewall. As such, it maintains a state table for connections that it has "seen", identifying the initiator, port numbers, expected TCP sequence numbers, and a Time to Live (TTL) which will "age out" the connection from the state tracking table after it has been idle for a period of time. While I suppose it's possible that these connections are sitting open with no traffic flowing longer than the TTL it seems unlikely, unless someone has modified the default TTL sharply down.
There's a finite amount of RAM in the Fortigate to track sessions. It would be worth reviewing the logs and administration interface to see if it can report on the total number of sessions being tracked and the maximum possible number of trackable sessions.
That log data totally has the look of a stateful firewall that has lost track of connections in its state table.