Yesterday I noted in my router logs that my wife's laptop accessed crl.comodoca.com. She was not using the machine at the time. A quick google search found three sites claiming this was an indication of a trojan, but all of them recommended using spyhunter for removal. I looked up spyhunter and it looked like spyhunter itself appears to be a scam.
I ran scans on her laptop with windows defender, Malwarebytes and the trend micro rescue disk. Nothing was found.
I looked at the logs this morning and saw that my main PC accessed the site while we were asleep. So this morning I blocked the site with openDNS, in my router firewall and added an outbound rule to my main machine's defender firewall to block the IP address (184.108.40.206) I added this rule to Defender in hopes that I can find the program or service connecting to the site.
Further google search shows that in 2016, Bitdefender was blocking the site but it seems from most posts this might have been a false positive. No one back then could find offending malware. It sounds like svchost was connecting to it.
Furthermore, some research indicates that this may be a legitimate certificate revocation list (crl) server, which I would not want to block.
I have learned from the comments below that it is important to NOT block this site, but the original question is off-topic. So I changed the question.