Thanks for all the responses. Here is some additional information:
  • I always have my AV software running, and it's updated at least several times a week.
  • I run Ad-Aware 6 around once every week or two.
  • I had already found the connection between Kerio and Tiny software. Tiny makes a firewall product, called Tiny Personal Firewall, which I use. It's a pretty good firewall, generally. I guess I was having trouble believing they could have something to do with it. Heck, I was even trying to use it to help identify the application generating the traffic! I'm surprised, and frankly disappointed by this kind of behavior. Even if it was just checking for updates, as was suggested, it would have been nice to know. I wonder what it's been sending.
  • I have turned off TPF, and am monitoring with Windump for those packets. Haven't seen any since. Will monitor for the rest of the day just to see. Yesterday, I had the same windump string monitoring, and it picked up the traffic about every hour.
  • This still doesn't provide what I wanted in terms of monitoring for which apps send out packets. Fport and TCPView can monitor what's running, but there doesn't seem to be a way to monitor - a la windump - for a given packet pattern from a specific app. That would be a cool thing to know, forensically. Especially when it's intermittent.

Thanks again for the help.