Unexpected listening ports seen with show netstat listening yes command on Panorama

When running the show netstat command there are ports are shown as listening that are not listed in the https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/firewall-administration/reference-port-number-usage/ports-used-for-panorama

Some examples are ports 28773, 28777, and 111 

> show netstat listening yes numeric-ports yes numeric-hosts yes 

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State 
tcp        0      0   0.0.0.0:28773           0.0.0.0:*             LISTEN 
tcp        0      0   0.0.0.0:28777           0.0.0.0:*             LISTEN    
tcp        0      0   0.0.0.0:111             0.0.0.0:*             LISTEN 
....(other lines removed for readability)

These ports are used for internal communication on the device.  While the show netstat command displays as listening for external connections, other mechanisms will drop any externally generated packets destined for these ports.  External port scans will not show these ports as available for connections.  Only the CLI show netstat command run by an administrator logged into the device will show these ports.