My router does not support UPnP (and if it did, I would have turned it off because I want to control what I open up to the public). I also disabled UPnP in the Parsec settings.

Some days ago, I found out that I was still able to connect to my Desktop PC from my notebook which was then connected to the mobile phone line using my phone. So I suppose Parsec not only tries to open up ports directly, but also "Hole-Punch" its way through.

While this is, undoubtedly, a nice feature, I'd like to be able to switch this off, as such things are always a security risk.