Going to the Handbrake site is a good clue (plus seeing a stream of a few MBs), and HTTPS doesn't protect them from knowing that, since they need to be the only site on that IP and/or use SNI, which sends the hostname in plaintext.