Graylog (on Debian Jessie) appears to be connecting to 220.127.116.11 which appears to be Amazon AWS in Ireland. Anonymous usage statistics are turned off. It may also be trying to connect to 18.104.22.168 which also appears to be AWS in Ireland. Connection is definitely from the Graylog process.
What information is it trying to send and is it possible to turn this off?