The scary IPs are part of DigiCert's CDN for OCSP responder (probably depending where you are and their anycast):
https://github.com/hoshsadiq/adblock-nocoin-list/issues/452
The "evidence" is the system made some network calls and DNS lookups. Which you know, you would do when validating a certificate. He also lists some SMB calls to the localnet which are clearly unrelated. tee.c source contains no network code so this would be truly easy to audit. So tell me again what is the damning evidence?
Also, are we to believe malware gangs are hosting on Akamai now? They must be in the major leagues.
And you call me an idiot?
Have a nice day.