Could you try picosnitch? (disclaimer, I'm the author of it)

It should be able to get the executable (and the hash of it) or at least give you a little more information.

Of those I only see 151.101.193.91 which was used for nominatim.gnome.org and dl.flathub.org, with the executables /usr/libexec/gsd-datetime, /usr/bin/io.elementary.appcenter, and /usr/bin/flatpak.

With nethogs running for a few minutes I saw:

  ? root     192.168.2.10:42650-13.225.195.73:80

which I was able to see in picosnitch as /usr/sbin/NetworkManager connecting to 204.pop-os.org.

If there really was a boot or rootkit, you probably wouldn't see any trace of it at all in picosnitch, opensnitch, or nethogs, since it could be hiding at a lower level than whatever anything running on your system can detect, and would therefore need an external firewall.