So, it looks like these messages are generated by pve-firewall querying an older iptables interface, which now generates these messages on newer kernels. It's annoying.
If you aren't using pve-firewall, you can stop/disable/mask it via systemctl. I'm not sure about downstream effect of it...