If battery life is the issue, start by looking at the drain from each app. Settings > Battery

If I had to bet, it was probably bundled in with some app she downloaded. There are so many shady games and utility apps that install their own spyware into the phone. It might not even be anything that she uses all that often. Once it's in there, it just does it's own thing in the background.

I'd go through the app list in the settings menu and close and delete any downloaded apps she doesn't use or recognize.

I'm not familiar with iOS, but I assume that it's similar to Android, and you can kill an app.

It looks like you have a counter there, which I assume ticks up for each connection.

Make a list of open apps.

Kill the first half of them.

If the counter stops ticking up, it was in that half. If not, it was in the other.

If it was in the half that you killed, kill the running apps.

Now open half of the "still suspect" list.

Repeat what you did above. Each pass eliminates half of the remaining apps, so you should be able to get it in log₂(N), where N is the number of initially running apps.

Looking at signalfx.com it seems to be a platform to spy on app/website users, so could be anything. If your block of the domain does not cause the app to malfunction and her to complain, the only way might be to inspect the traffic. But that might require setting up a mitm attack with forged certificates. You might not want to go that far.