seeing as how its such a common process its hard to guess without shutting it off
i have noticed a wierd quirk with some firewalls and scvhost.exe .
if your familiar with windows xp thumbnail previews, it will preview pics and html files with a small thumbnail in your browser.
now lets say you had an html file with an image hotlinked to an off-computer image or file or maybe just a shortcut or favourite html shortcut it will actually go and get the info for the html file to display the thumbnail preview.
Now i have noticed that this doesnt usually cause the firewall to give any message because its technically explorer that is already allowed, but... when you use a third party program like photoshop or adobe and go to insert images into the program it will open the explorer interface to let you "open" a file, now in this thumbnail preview it will cause the scvhost.exe to throw a warning to your firewall that it is connecting to the internet to get an image that is in a html file that its trying to show a preview thumbnail for..
ok im sure that made no sense but... lol
my basic theory with computers is ... close everything thats important when u have a problem backup your hard drive to disk.
then start closing stuff u dont like until things stop working , then u write down the name of what u turned off
then u make a list and