Graylog (on Debian Jessie) appears to be connecting to 52.17.197.100 which appears to be Amazon AWS in Ireland. Anonymous usage statistics are turned off. It may also be trying to connect to 52.51.53.188 which also appears to be AWS in Ireland. Connection is definitely from the Graylog process.
What information is it trying to send and is it possible to turn this off?