Something strange

A. THE BUG/ISSUE (Varies from issue to issue)
Can you reproduce the problem & if so how reliably?:
Yes
If you can, exact steps to reproduce. If not, exactly what you did & what happened:
1: Started a browser, in Secure shopping or “alone”. No problem when browser in Container.

One or two sentences explaining what actually happened:
Not shure, what is this… Host process for windows services downloads about 3 megabytes from 104.16.91.188:80. I have captured some traffic with Wireshark (the 3 MB.pcapng).
One or two sentences explaining what you expected to happen:
Not expected to happen this.
If a software compatibility problem have you tried the advice to make programs work with CIS?:
No
Any software except CIS/OS involved? If so - name, & exact version:
NetLimiter 4.0.33.0, Wireshark Portable 2.4.2.
Any other information, eg your guess at the cause, how you tried to fix it etc:
MITM attack?

B. YOUR SETUP
Exact CIS version & configuration: CIS 10.0.1.6294, Internet Security.

Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
HIPS: Safe mode, Auto-Containment: Enabled, VirusScope:Enabled, Website Filtering:Enabled, Antivirus:Stateful, Firewall:Safe mode.
Have you made any other changes to the default config? (egs here.):

Have you updated (without uninstall) from CIS 5, 6 or 7?:
No
if so, have you tried a clean reinstall - if not please do?:
No
Have you imported a config from a previous version of CIS:
No
if so, have you tried a standard config - if not please do:
?
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 8.1, 32bit, Administrator, no v.machine.
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=Secure Shopping 1.1.421657.99, COMODO Internet Security Essentials 1.2.424651.94

It downloads a certificate revocation list.

It is necessary to download CRL every time I go to vk.com?
It did not happen to another security software.