ipa-otpd is socket activated. Its lifecycle is identical to the socket which activated it. The KDC activates it at most once per worker process. The KDC has 8 worker processes by default.

Every time you authenticate, it is likely hitting a new KDC worker process which handle incoming requests effectively at random. Hence, what you are describing is the correct behavior up to 8 processes (or the number of KDC workers you have configured).

A simple "systemctl stop krb5kdc.service" should cause all the ipa-otpd processes to exit when their sockets are closed.