Why do i need to allow svchost.exe in a VPN killswitch rule, and not other proc?

Hi. I am wondering about this:

Why do i need to allow svchost.exe and why can’t i have it in the VPN rule? If it’s in the VPN rule, i get no internet at all.
If i allow it, i can put most other windows processes in the VPN rule. Please educate me on the topic. Also. how do i block these in comodo:
stat.comodo.com
cmc.comodo.com

?
Thanks

Hi again. Does anyone know if it’s possible to see pid and traffic in windows?
I don’t have a working killswitch, maybe because of svchost.exe.

Anyone with knowledge on the topic?
If the killswitch is active, i can see traffic from my antivirus, comodo and windows and some i dont know what it is. How do i block it? Thanks!

Examples:
c.cwip.eset.com
cs648.adn.phicdn.net
dns.msftncsi.com
cs139.wac.edgecastcdn.net

I need pid and traffic before i can block it. Not fully sure if i can see the traffic and that they get blocked when i look at the traffic though.