Svchost.exe should have any incoming connections. Block them. Svchost.exe only uses outgoing connections to obtain/update IP and for DNS requests (so that’s port 53, 67 and 68). Of course Microsoft is annoying, and wants it to be a part of Windows Updates, so you’ll need to allow port 80 for Windows Updates (BITS Service).
Comodo shouldn’t alert you everytime you boot. If there’s already a trusted zone, why create a new one?
If you stopped screwing with things and left Comodo alone you would be better off. svchost,explorer.exe and system should only have outgoing. There are several posts about this and I even included and screen shot and should you. I can unplug my modem and Comodo doesn’t do anything and either does ZA. Why cause it already found my connection and I trusted it When you unplugg your modem that doesnt make a firewall find a new connection. When a firewall finds a connection its not your modem it finds its your eithernet connection it finds. Such as Intel100.