If you haven’t got a rule for it, in Application Rules, it shouldn’t be connecting…
maybe you could try putting the firewall in Custom Policy Mode and alerts to Very High, see if that captures svchost trying to connect.
Edit: I forgot about that default application rule Dennis mentioned, I always delete it!