Depending on what services you have activated on your appliances, that is normal for the GWs to go out to Internet for different things.
Updatable Objects, IPS updates, Antivirus updates, license checks, etc. , etc. , etc. ...
If you look into the logs with the URL view, you will see the URL that is addressed and if you have HTTPS Inspection blade enabled, you'll see the HTTPS ones too...
Enjoy,
PS: forgot to mention, but if you set the GW as a proxy, then all Internet traffic from clients will show as initiated from the appliance.... just an ideea