Deauthentication packets sent frequently or in large numbers could be an indication of a deauthentication attack, where an unauthorized user attempts to disconnect legitimate users from a wireless network by sending deauth frames to their client devices. This could explain the intermittent connectivity issues being experienced. DNS queries or successful DHCP leases are normal network functions and would not typically be related to a deauthentication attack. While excessive TCP retransmissions may be a symptom of packet loss or poor network conditions, they do not directly suggest a deauthentication attack unless they occur immediately following deauthentication frames.