Firefox constantly sending data 3KByte/S to Cloudflare servers

And you don't have Cloudflare set for Firefox DNS over HTTPS as the provider? (It should not be requesting things constantly even when idle but there's enough internal service endpoints to hit even in background to generate DNS traffic however I'd expect for the same hosts this to be reasonably cached to start with.)

If you create a new clean profile without addons and no tabs/sessions to restore, do you still see it?

Generally most of Mozilla traffic terminates at Fastly POPs, incl. OHTTP and IP protection features.

If I open Firefox with a clean session and do not navigate to a web page, Firefox remains silent and does not start sending data.

I have configured Firefox not to use DNS over HTTPS so it should not be polling Cloudflare at all.

After navigating to any site for example Amazon, Google, etc. Using windows resource manager Firefox can be seen connecting to and constantly sending data at around 3KByte/S to one of the four following IP addresses, although there may be more.

172.67.192.95 172.66.172.219 104.18.11.183 104.21.20.113

All of the above trace back to Cloudflare.

I have configured my firewall to block access to the above IP addresses and I have now ceased using Firefox as my trust in it is significantly diminished.

To me this represents a substantial security and privacy threat. I would like to know what data is being sent and why.

Additionally, I note if I close the tabs with the websites that have been visited and just leave the browser open on a blank tab, the network activity continues until Firefox is closed.

You can check the about:networking page for any additional info. This is the same as https://support.mozilla.org/questions/1368391 or https://support.mozilla.org/en-US/questions/1387375#answer-1530837 basically — you'd need to capture the host for the connection to tell anything useful. Like I said, you want to test with a separate new profile first to rule out any addons, as from the internal list of services Domains to allow for Firefox there's nothing hosted at Cloudflare, unless you use their DoH endpoint.

This is the same list as CNAMEs to get the idea about termination: https://www.onlinednslookup.com/bulk-dns-lookup/c78fd861b5cdadaf419d241675a721a0/

This is the longer list with IP resolution incl. networking identification: https://www.onlinednslookup.com/bulk-dns-lookup/c78fd861b5cdadaf419d241675a721a0/A/8.8.8.8/1/0/1/0/0/0/

You might wanna check out How to stop Firefox from making automatic connections for the types of connections and their settings.

Also notably using "for example Amazon, Google, etc." as the sample might be better to avoid at first, to rule any service workers from the content running https://www.w3.org/TR/service-workers/#service-worker-lifetime … esp. since the actual *.workers.dev amusingly sits close the network ranges you're tracking down — so you might wanna stick with "1990ies" websites as https://www.math.utah.edu/~beebe/support/html/Docs/whats-new.html or https://mozillamemory.org/about.php.html to open up and see if you still the see the same connections.

I wasn't able to get any reverse lookups on the IPs listed, so you'd need to either log your DNS resolving or (MITM)proxy HTTP traffic to get the idea of what's the real hostname behind these.

FWIW I got those IPs and/or their neighborhood for some asset/resolver scan archives, so I picked e.g. this one pointed at that A record:

https://www.nslookup.io/domains/api.coingecko.com/dns-records/

You sure you're not running any addons that would be keeping connected for similar purposes?