All the same non user initiated calls to Mozilla and other endpoints. Run tcpdump to see them. (both TCP and UDP now) I run a command before I close internet applications and all outbound connections are logged in dmesg via netfilter. Be sure to also log all DNS queries on your firewall.