SMTP invalid reply for 221 response

We have a public facing mail server and we see a lot of SMTP invalid reply alerts when it issues a response like:

530 5.7.0 Must issue a STARTTLS command first
221 2.0.0 Bye

Now, I suppose this is indication of a failed attempt to send mail through it, but it’s not really an “invalid reply” and it’s not unexpected.

Do you have a pcap for that or can forge one? That would help to see if it’s a valid trigger or it needs to be extended to detect this as valid traffic