Does Sophos Endpoint use DNS for comms with Sophos Central? I've seen lots of DNS queries of type TXT going to urls along the lines of:
3.1o198r00n57o62rrp3743xxxxxxxxn7p8n1p328q8uew742o437qp83152.48s2p9q4on2q5892367xxxxxx497rs238p3qp2859q3pp2q02nq2…