We are experiencing a strange issue where we've had a Polycom VVX 311 phone reaching out to websites that an end user has navigated to on their PC. Our PC's are daisy chained to the phones and we operate on Cisco switch with regular access VLANs and voice VLANs. In our firewall logs we see an end user with an workstation VLAN origin IP reaching out to a website, then later in the firewall logs (over the course of a few days) we see random connections from the Polycom device IP (on the voice VLAN) reaching out to the same website on port 80 followed by port 443.
Our users do not use the BToE application.