I'm not choosing a side here, but saying "we have Wireshark" doesn't mean as much as you think it does. If packets are encrypted and sent at arbitrary times, we really have no idea what is being communicated. Surely we could see large amount of data if they were transferring entire audio sessions, but I feel like they are far more likely to send transcripts or key word mentions. Given the size of keyword mention, it would be very hard to distinguish this from a normal query to Google.