I have a little snitch rule effective in all profiles to allow any process to connect to *.apple.com Why do I keep getting request for applications to connect to apple.com? Here are 4 different processes requiring permission. I thought that the rule above should cover these...??
On closer examination of the rule in the picture, it looks like it is set to Hostnames apple.com, not Domains apple.com, which may make all the difference.
If not, try adding a duplicate Domains rule also for System processes, as well as 'My' processes.
If that spits out any duplicates, you can then clear the others.
You may find some are locked - so disable or just leave as a dupe, it won't actually hurt anything.