Do some traffic analysis on the upstream end of an ethernet cable plugged into that computer while it is hibernating or sleeping some time, you might not like what you what you find.
Is this something you know for a fact, or are you extrapolating from intel ME?
It's funny that you'd think real-world espionage by intelligence agencies would be sending that data to headquarters rather than some random commercial VPS set up as collection infrastructure that is deliberately unattributable to the organization behind the espionage.
Blocklisting, that's a cat and mouse game. Go look at how many different URLs and IPs are utilized for commercial telemetry in the likes of Adobe and Microsoft software if you aren't familiar.