Why peak shows on graph when network turned off

First let me say I have blocked Windows entirely from going on the net, including blocking Windows Host itself. I only go online in a guest Linux OS running in a VM while the host machine is blocked. When I start my Win 10 system at the beginning of the day and then open GW, a peak appears on the graph. GW reports that this is Windows Service Host Management, or something similar, if I remember it correctly. Often this is reported as blocked, but sometimes as unblocked, in which case I block it again. In both cases it never reappears for the rest of the day. This raises three categories of questions to mind.

  1. Why is this peak appearing at all if Windows is supposed to be entirely blocked and there is no network connection whatsoever at the time? (could it be GW itself?)
  2. Is an app or service attempting to send a packet of data and since there is no internet connection it just fails and the packet is deleted? Or is the send attempt put into a que and automatically sent anyway as soon as network is turned on and a connection is made?
  3. Why is something previously blocked suddenly, and seemingly at random, popping up as unblocked, though at other times remaining blocked?

I’d have to see to be sure, but if you check the host is it a local IP? It’s probably your PC attempting to have some local traffic, searching for other devices, etc…