If your requirement is to drop web traffic to uncategorized sites, you may need an explicit rule to drop it.
The reason why is that for Application Control/URL Filtering to work, traffic has to be permitted to pass from the specified source/destination/service ports.
Only after some traffic has passed can traffic be properly classified, matched to the relevant rule, and the appropriate action applied.
Note that identification is a continual process.
A given flow can initially be allowed because it looks like an allowed application.
Once it looks like an explicitly unallowed application, the flow will be dropped.
If the connection terminates before an identification can occur, then the traffic will ultimately be allowed.
That could be what's happening here, but I'd need to see the full log card, and/or do some additional troubleshooting that would likely be better done by the TAC versus in a public forum.
Regardless, you're better off always including an explicit rule to drop uncategorized sites if that is part of your requirements.
It generally doesn't take more than a few kilobytes of traffic to identify these connections.
