there's traffic that gets through services like netguard that's calling home to services like mtalk.google.com and google play. This traffic comes up when doing router level DNS & traffic monitoring.

this has also been observed on an AOSP device that does not have Gapps installed.