They still see traffic to an IP, and the hostnames in the certs. Also the request/response lengths can reveal what was fetched