OK, the LLM thinks I solved it, but would like feedback.
Here is a better screenshot of the AGH logs. The area of interest occurs @
11:17:51 According to the LLM, the context/proximity to Google API calls, insinuates that they may be launched in tandem:
https://i.imgur.com/DuHMfLF.png
Being generally privacy-conscious, I have
trackercontrol enabled and cross-referenced its logs. One caveat is that the dates aren't shown, so I'm assuming that it's for 11/5 but cannot tell definitively. Relatively sure I didn't use the tablet yesterday morning tho.
If I'm reading things right, push.boox.com conveniently launches @
11:17:51 as well:
https://i.imgur.com/TCUsWym.png
Edit: Then again, there are both ivp4 and ipv6 DGA domains, but only ipv4 push.boox.com...