When IPS URL Reputation is disabled, the SEP (Symantec Endpoint Protection) or SES (Symantec Endpoint Security) client still generates a lot of DNS requests for sp.cwfservice.net.
The feature shares a setting with Insight in the external communications configuration.
Repeat requests are due to lookup failures if the lookup is blocked.
This issue is fixed in Symantec Endpoint Protection (SEP) 14.3 RU2. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec software here.
Allowing the requests instead of blocking them should prevent excessive retries.