How do I trace a device trying to connect somewhere across the world

You're in the UTM subforum, not XG (or sfos).

Kaspersky still working well here, no plans to remove it at this time.

Re tracking, your best bet would be to run tcpdump on the pihole instance. Don't know the exact parameters off hand, but there's a sequence that will monitor for a particular host.  Give this a read https://danielmiessler.com/study/tcpdump/ . If you get no hits then run it on the firewall.

I have UTM firewall. I’m trying to look through my firewall. Even did any-any-any with my firewall and click log traffic, still a no go. I’ll run a tcpdump. Thanks

My apologies, your break out of the various vlans looked like a xg setup.  Unrelated, what AP's are you using that support vlans?

Is there a dns host type definition under network definitions?  If so, my guess is even if the object is unused, utm will still try to resolve it.

Putting 77.74.181.41 into a browser brings up the forum.kaspersky.com site

My goodness!  You solved it.  I have it in my network definition.  I deleted it and the queries stopped.  Thank you very much.  I was getting paranoid.  Anyway I use unifi AP.  It support VLANs but only a max of 4.  The the more vlan you use, the "slower" throughput is.  

Glad I could point you to the fix.  Probably a good idea to trim the list periodically of stale entries.

My current wifi AP consists of a netgear orbi. It's a rather (using the term mildly) dumbed down consumer device but the wifi reaches far and works well - 160mhz ax capable. At the moment it's only serving a few phones/tablets and iot devices. All on the same subnet. Pc's are all wired.

My eventual goal is to put a switch capable of mac based vlans between it and the rest of the network. This should allow me to segregate traffic once it leaves the AP. On the AP, the various devices will be in different subnets (ie 192.168.1.0/24, 192.168.2.0/24... etc). They'll still be in the same broadcast domain, but will have some level of isolation.

Btw, such entries are logged in the system log.  Made a test dns host entry called test.com.  The following showed up in the systemlog.

That's why I couldn't find it in my firewall/web filter log.  It's in the system log.  I saw it.

2022:04:23-02:29:45  dns-resolver[5434]: Adding REF_NetDnsKaspersky
2022:04:23-02:29:45  ntpd[4614]: ntpd exiting on signal 15 (Terminated)
2022:04:23-02:29:45  ntpd[4614]: 127.127.1.0 local addr 127.0.0.1 -> <null>
2022:04:23-02:29:45  ntpd[4614]: 144.172.118.20 local addr 73.71.15.192 -> <null>
2022:04:23-02:29:45  ntpd[4614]: 65.100.46.164 local addr 73.71.15.192 -> <null>
2022:04:23-02:29:45  ntpd[4614]: 135.125.255.100 local addr 73.71.15.192 -> <null>
2022:04:23-02:29:45  ntpd[4614]: 132.163.97.1 local addr 73.71.15.192 -> <null>

My unifi is wifi 6e capable also.  Ceiling mount, set and forget.  It's on my 2nd floor ceiling.  It reach even a few feet outside my house.  I only bought it for $169

Nice!  This was free, so can't complain

Yours is even better.  Free is free man.

Yours is even better.  Free is free man.