After disabling both URLReputationFiltering and URLReputationContent from Filtering.xml, you still notice that there is traffic going toward URL filtering URL http://sp.cwfservice.net/
Filtering.xml:
<URLReputation enabled="false">
<URLFilter enabled="false">
SPE 9.x
This behavior is expected. Even when both URL Reputation settings are disabled,
SPE will still attempt to communicate with the URL http://sp.cwfservice.net/ as part of its initialization process and following LiveUpdate sessions. This is a standard operation and not indicative of an issue.