• captiveagent detects when you're on a captive-portal network, it does this by checking for known-content domains apple controls
• helpd is the daemon that connects to Apple's online help docs
• locationd powers location services
And so on. These are all easy to google. Come _on._ >:[
> Does anyone know what the nbagent process is?
> ...
> It appears to be something related to Software Update and/or the Mac App Store, so allowing it seems safe. I'd speculate that it showed up in the latest OS X update since I'd never seen it before today either, and the first google hits seem to appear only very recently.
Sorry, while honest good effort, that's not acceptable answer. And that's before we start investigating processes that do connect AFTER login - what the heck is "systemmigrationd"? (try googling that).
Sorry, but macOS regarding privacy is almost as bad, as Windows. It has many processes that connect somewhere, it is uncertain what these processes do, etc. How can someone even audit that?
Compare to CentOS/Fedora, where the only hit to internet during pre-login is either DNS or your configuration and all the other hits are user-initiated (except browsers, which do update their certification revocation list, unsafe-urls list, etc).