odd behavior in the active connections window

No, I think HHCTRL is a Microsoft component. An HTML Help ActiveX thing, used by MS Office amongst other things & linked to your 1904 error (according to Google).

But, it does sound like your missing something.. with the no description for Event ID. However, these types of things are often dropped, along with MiniDumps, as a performance measure.

Why would CIS create rules? It does that based on it's setting. With the Firewall on Safe Mode, it would generate rules for applications certified as 'Safe' by Comodo, or as a result of user responses to pop-up Alerts.

Why would CIS create corrupt rules? Because the underlying data was indeed corrupt, although the extent of that corruption is not clear. CIS didn't noticed and continued as if everything was fine. I suspect that "in theory" this situation cannot happen and that's why there was no functionality to verify data on the fly to prevent it.

In therms of the application, to the best of my knowledge there is no difference between CIS free & CIS paid. CIS paid adds 24/7*365 technical support (a real human!) when you want it.