Hey!
I stumpled upon this thread, because I have a similar issue. I have a Moto G5, rooted and with a 7.0 debloated stockrom (no/blocked googleapps except chrome).
I'm using AFWall+ to "block" apps phoning out, but there is one app with the ID:1000 / Name: com.qti.service.colorservice which is constantly trying to break out. The AFWall log gives me the IPs to which this "service" is phoning. There are at least 15 IPs alone and all are starting with 52.85.184. For example 52.85.184.214 ; .215, .73, .74 and so on. All of them are Amazon hosted.
Don't know what to do with this information. What I know is, that this "service" is not draining my dataplan but my battery.