I started receiving notifications that we've reached our licensed API call limit after recently activating the Salesforce Securlet.
The Salesforce Securlet will use up to 50% of the licensed API calls, at which point it will pause and wait for the next time period with available API calls. If normal usage is 50% or more, CloudSOC will self-throttle and no additional API calls to Salesforce will be made in that time period.
Working as designed.
Once the initial scan is complete, the API call volume will drop drastically.
The progress of the scan can be checked in the ServiceNow Securlet dashboard under View > Details of Scanned Items.