Just check where the data is going,by checking size of windows folder & C drive after every 15 min.In windows folder focus on software distribution folder.If not windows folder then check Users folder in C drive(focus on <your username>\appdata). Before doing all this,make changes to default windows folder view settings to show hidden folders & system folders/files.
Another evidence that strongly supports some "official/updates downloading" theory.I already blocked many IP addresses using Firewall and Antivirus but still faced the issue...every time some new random IPaddress was traced.