Most is malware these days. Checkout Safing Portmaster and config blocking various outbound connections and pick a good DNS filter like AdGuard. Then if you get malware it won’t be able to connect to CnC server.