I'd pcap a bunch of the traffic -- in particular the DNS requests -- that will tell you where it is connecting. Hopefully it is using TLS, and then the SNI headers can give you more information.

I run a local DNS resolver and so I capture all the lookup responses so that I can turn IP addresses back into names. Depending on what firewall/router you have, you may be able to log connections. I use a locally hosted free Gravwell process to grab these logs and correlate with the DNS queries to find which systems are talking to where. If your home network is like mine, then there are probably a bunch of systems that you want to block from talking outside.