The browser sends a query to an OCSP server to verify the current validity of it's ssl/tls certificate.
Yes, with OCSP the OCSP could figure out which site the user visits. It cannot figure out which URL but it can determine the certificate the browser tries to access and thus which site. OCSP requests are not done for each HTTPS request to the same site but the response is cached for some time. Some server periodically get the OCSP response from the OCSP responder and send it together with the certificate (OCSP stapling). In this case the browser does not need to query the OCSP responder itself which is a good thing for privacy and also for performance. Apart from that the Chrome browser does not make use of OCSP anymore but instead has there own curated list of revoked certificates. Not everybody agrees that this is really the better way.
It also queries a service to check if the website is malicious ("block reported attack sites" on firefox)
Initial versions of this feature (Google Safebrowsing) checked each site by asking a central server but this was long ago. Today a local database is updated regularly and checks are done offline against this database. Only if this offline check indicates that the site might be malicious it will go online and verify this with the central server. Thus this feature is no longer much invasion of privacy.
But there several firewall/antivirus products still behave this way and send unknown URL's to the firewall vendor which then makes another access to analyze the potentially malicious site. Some vendors even go as far as selling these profiles to interested parties like advertisers.