comodo killswitch connection anomaly or normal?

I'm having a minor connection issue with vpn so I'm looking more closely at network. win7x64 cf_v10.2.0.6526@csconfig
I'm seeing when killswitch is running, it is always online with at least 2 connections

TCP 178.255.82.5 80 Established
TCP 104.16.60.31 80 Established

is this normal?
I don't exactly recall that from the past, but maybe it was. Looks like the ip are for
download.comodo.com
cloudflare

the other day I had cf open and asked it to check...

comodo killswitch connection anomaly or normal?