From what I've read this is built into the required wifi router for Xfinity. I discovered this when I signed up for Xfinity fiber, had the fiber installed and setup and then cancelled it the same day, because of this and not being able to buy and run my own hardware, and needing to install an app on my phone to manage the router, and apparently not being able to choose my DNS. They required that I rent their hardware for an additional $15/mo. Oh well, at least fiber is in the house now, if anyone wants it in the future. I sure won't be paying them to spy on me.
Fuck Comcast, still.