There might be some connections from the GW to Akamai that is not part of Check Point Services object.
for example, in sk116590, there are several Akamai hostnames that are not part of Check Point Services such as:
There are more examples on this SK for hostnames that is not part of "Check Point Services".
The reason is that these hostnames are not hosted on Check Point and can't be called "Check Point Services".
However, it's a legitimate traffic originated from the GW.
You provided some examples for CRLs that are part of our object.
These domains added in later stage to improve customers' experience after we understood they are required for several products.