sounds the UI has a lot to say ;D … or are all these connections needed just for the IS ad ? see screenshot, interesting 
…wondering what the behavior shield is actually doing in the meantime 
nslookup-ed about half of the displayed IPs - and all belong to avast! updating servers.
So I guess it’s simply the checks for virus database or program updates (trying a random server from the list each time)…
On the other hand, the IS ad is an interesting idea as well… no idea how often it’s refreshed, might be possible.