After some recent AV/FW software update (Comodo) and restarting my computer, I was alarmed with big amount of warnings that application "x" (where "x" is pretty much all of what I try to run) try to establish outgoing connection to adress 18.104.22.168 (or sometimes similar adress from same range). Even if it is some dummy app I've just created, or any app that has nothing to do with internet. Besides that "System" process itself tries to send these IGMP requests as well requests. 5 connections per minute on average. There was also increase (or FW update triggered oversensitivity) with traffic on ports 137 and 138 UDP, which I fixed by disabling NetBIOS.
My question is: What can be the cause of this? Is that normal? Did my firewall got oversensitive with the latest update, alarming me of some inner Windows stuff that happens all the time? Or maybe I've catched something malicious (Comodo / Spybot Search and Destroy seem not to raise any red flags). What else I can use to check/clean my system for threats that can be applied over my current AV.FW (Comodo)?
Freshly installed system with all updates seem to behaviour same exact way with less intensity so far. Scan with Windows Defender offline didnt revealed any problems.
Im basically out of ideas and still wonder if its caused by some recent system update or maybe faulty firewall software. And if its caused by some rootkit how to reveal it and get rid of it.