Not sure if anyone brought it up yet, but these processes are actually bitcoin mining software in the form of malware.
Tracked the traffic back to a central stratum mining address.
It deletes itself after it runs and runs in memory to prevent deconstructing it.