I have a network-wide pi hole and I noticed that it requested activity.windows.com, a url blocked by my pi hole, even while my pc is suspended. I pinged 10.0.0.217 and it is currently unreachable. So, somehow, windows pc’s turn on networking, phones home, and turns off even while suspended.
Creepy behavior
This sounds like the kind of thing that might happen if you have some kind of automatic sync set up, like when you plug your phone in and it automatically copies photos, or perhaps a cloud service that’s syncing photos?
My phone is never plugged into my computer and I don’t have any service like that running that I know of.
It could be OneDrive (though I don’t use it at all) or even the ghost of the Explorer iCloud plugin.