"System" is the Windows kernel, in some respect or another. From userspace, the Windows kernel is basically opaque, and you can't examine the behavior of its subsystems or drivers. It could be:
- A device driver, such as a VPN or netfilt driver
- Some kind of packet capturing software that has a kernel driver
- Some system service that is moved into the kernel, maybe DRM for video playback
Depending on which remote hosts are being connected to, you should be able to determine if it's malicious or not. If it's just connecting to localhost or a local subnet (such as 127.x, 10.x or 192.x) I wouldn't worry about it. If it's connecting to remote hosts on the public Internet that you aren't familiar with, especially if they have domain names or a reverse DNS entry pointing at a domain name, you might worry, depending on what those domains are.