After installing Endpoint Protection (SEP) or Endpoint Security (SES), some clients are seen attempting to reach Google DNS servers at 8.8.8.8 or 8.8.4.4.
SEP/SES
This is expected functionality.
This is expected functionality if LiveUpdate fails as it will try to resolve the LiveUpdate servers using these alternate DNS servers in an attempt to try to connect successfully in case the cause of the issue is a DNS failure/invalid IP returned. There is no way to disable this functionality however these IPs can be blocked at the perimeter if you do not wish to allow lookups to these IPs which would prevent it from being able to use this as a fallback.