Firefox

You can see the requests for Pocket, certificates and the captive portal check since those are in the actual url name. In addition to those, FF phones home for browser updates, extension updates, FF sync, safe browsing, etc.

I just googled a few URLs here, and found the following:

mozgcp.net is the Mozilla Google Cloud Platform, looking at the links it connects to, it looks as if it is accessing settings for Google, then finding some certificates, accessing pictures for the Pocket service and doing some product detection, why, I have no idea.

moz.works is Mozilla's content delivery network, porbably nothing to worry about.

mozaws.net is probably a service running on AWS, the autopush service seems to deal with the Push API: https://developer.mozilla.org/en-US/docs/Web/API/Push_API

mozilla.com looks quite benign at first glance, but googling firefox contile tells you that that service is used to push ads on the new tabs page: https://mozilla-services.github.io/contile/

Sounds like it's pretty standard, benign stuff. Luckily FF is open source, so if this freaks you out, then try one of the more private forks like LibreWolf. You won't see these same connections there.

Looked up 2 of them, seems like they are settings and files, stored on Googles servers, but encrypted by the time it reaches Google.

Short of someone with a quantum computer, I doubt anyone will decrypt them, along with the billions of other user files out there. Suffice to say, don’t store/link anything sensitive if you’re worried.

Blocking might just break features, but be wary to see what’s broken based on what’s disabled and see if it can just be manually disabled in settings first.