Looks like one of the answers in the Twitter thread mentions that this might be cached content. Is this confirmed that the network call is actually being made (by router for example?). Cause later down the line it seems that pf blocks the calls just fine.