the marketing name is "Mail Drop", and it is separate from iCloud mail; though it should only fire if there's a 20mb+ attachment on the email.

cloudd is used by a shit-ton of services though, so I'm not sure how to track it down without better tracing of what actually initiated the call, or the contents of the call.

edit: tomasf nailed it - https://news.ycombinator.com/item?id=49158388