When IPS URL Reputation is disabled, the SEP (Symantec Endpoint Protection) or SES (Symantec Endpoint Security) client still generates a lot of DNS requests for sp.cwfservice.net.
The feature shares a setting with Insight in the external communications configuration.
Repeat requests are due to lookup failures if the lookup is blocked.
Our Engineering team is investigating this issue and will update this document when a solution becomes available.
Allowing the requests instead of blocking them should prevent excessive retries.