SANS ISC has published a technical diary looking at the network traffic a macOS 27 'Golden Gate' system generates when it boots, before a user session begins. The goal is to give defenders a sense of what normal startup activity looks like.
Having such a baseline matters because pre-login traffic can be overlooked during investigations. If defenders know what the operating system typically contacts at boot, they can more quickly identify unexpected connections or other signs of malicious activity.
With only one source, there are no independent comparisons to draw from. The diary itself is the sole point of reference, and the excerpt provided does not list the specific endpoints or protocols covered.