Having CRL/OCSP getting blocked on corporate networks is one of those things I have to commonly troubleshoot. You can get some weird timeouts and failures in applications that can be fun.

For example an internal app starts up fine and works, but then can't connect to github. Instead of showing cert errors, I've had ones show errors that make it appear that you may have a DNS problem or that the connection to github itself was broken.

If I was still using windows I would totally block everything and run a wsus server in a VM that has a vlan and firewall config.

The issue is you can only control your firewall at home. Whenever you are out you are pretty sure that MS and Apple bypass any rule you'd put on the local firewall.

I prefer running sane operating systems.

Pretty sure your sane OS makes calls to CRL/OCSP lists to validate cert revocation. Many of the calls in that list do just that.