Sounds like Microsoft Defender/other AV sandbox running it to check for malware, Ive seen it happen in the wild in a similar fashion. A client was running software with phone home licensing and the vendor auto disabled the license after AV sandbox runs touched their license server from the sandbox IPs. I think Quark also had that issue for another ckient, but that was almost a decade ago.