Did you happen to capture the port the data initially goes out to? Rachio primarily uses secure MQTT connection to AWS (port 8883).
Theoretically controller should connect to one of these:
Anyway you can (wireshark) capture what is happening during bootup?
— Likely answer —
Searching through the IPs you’ve listed, a lot of them seem to be a part of the europe.pool.ntp.org (have not checked the complete list to be completely sure). In any case seems that your controller is trying to get it’s time from one of the European NTP servers… Data should not be encrypted, meaning that wireshark or packet capture should provide a definete confirmation.