Connections to apple streaming source CIDR blocks, connections to apple auth CIDR blocks, and a bunch of ips in apple blocks I have no idea what they do.

Apple domains are easy to identify. https://support.apple.com/en-us/101555

A lot of it associated with iTunes and apple store stuff like mzstatic.com but also https connections to unknown domains. It's almost all https, so impossible to say what's being sent.

The content streams are easy to pick out, because only a handful of stateful sessions go to known CDNs.

Why starting a movie or show on an apple TV requires a check to siri and search is probably explainable, but certainly 1400 requests during movie play to diagassets.apple.com (the "diagnostics" domain known to be a black hole of Apple mystery) is probably reporting data of some kind.

It goes on like that, mysterious connections that occur during video play and at startup to domains like Apple Education raise a few eyebrows.

And then there are the plugins, which do a lot of phoning home.