Whenever a device needs to connect to a web domain, the first thing it has to do is retrieve that domains IP address. Thats a DNS request.

While I don't remember which domains exactly (this was 5+ years ago when I last checked); just the fact that it's reaching out to external connections 20k+ times a day is concerning.

For context; my entire network has made 28k dns requests in the last 24hrs. Thats 3 mobile phones that are in use constantly, three PCs, and a handful of IOT devices like smart bulbs/switches.

20k from one device is A LOT.

It's primarily an idle device that's awaiting a voice command. Supposedly it's processing audio locally to find the wake word 'ok google' and only then uploading the audio to be processed as a voice command on googles servers. So what's it uploading/connecting to 20k times a day while it's suposed to be idle...?

Like it's trying to connect to where? Why?

I don't know exactly. That's the problem.