What is sending packets to Google

[#1]

See picture and note that there isn't a Firefox process running

[#2]

Probably a separate update program that is part of Firefox.

[#3]

More likely the built-in search tool.
216.58. IPs crop up everytime you start FF. They continue after you've closed FF.
Odd thing is, doesn't make any noticable difference if you block 'em. (FF still updates fine, search works, etc.)
If curious check for ubiquitous Amazon IPs, too. (54, 52, etc.) Loads of 'em when you fire up FF (before going anywhere or doing anything - about:blank). Again, out of curiosity, blocked 'em, just to see. No difference. Everything still works fine...
They love their telemetry... don't ask...
Main reason I block 'em is because they also arise when checking for email on my own ******** server via Thunderbird. Again, works fine without... Updates fine, etc., etc.
?

[#4]

Firefox will periodically update lists of malware and phishing websites from Google, but I think it only does this while it's running. This can be disabled in the preferences, untick "Block reported attack sites" and "Block reported web forgeries" in the Security section, but disabling those would make your web browsing slightly less safe.

[#5]

Yes !,  Google Safe Browsing for Firefox would need updating regularly.
I have Google Safe Browsing implemented in my router, and that fetches the malware database every hour, to keep security up to date.
The great thing about doing it in the router, is that it doesn't matter what device you use on your network to browse the internet, as all web traffic is scanned for malware, phishing, and viruses as it comes in from the firewall.

[#6]

Good tip, thanks    Never thought of it!
Don't have safe browsing active on FF tho, btw. Not sure why continues activity after FF is closed. Probably just wating to finish... whatever it was doing...