Couple that with monitoring the vast amount of ETW logging providers Windows gives you, and you'll see why. E.g.: the WinHTTP provider of who (PID) contacted where including URL, DNS ETW for lookups and who (PID), etc.