Those messages get a D- for technical content and accuracy. The most likely explanation is that these packets arrived late and failed the
ESTABLISHED,RELATED check because the connection was already closed.
Somewhat less likely is that they actually had the
CONNECT flag set in the TCP header, and your firewall is either dropping all incoming connections or the target port was closed.
Random incoming connections can occur due to malicious port scans, but also due to dynamic IP allocation giving you an address which was formerly allocated to a user of peer-to-peer/mesh transfer software, such that the address has been advertised in the mesh. However since these are coming from sites that you do use, more likely is that the packet arrived after you already moved on to another webpage, and the browser was no longer listening for the data in question.
Unfortunately, describing the firewall action as a "block" is lacking in information as well. There are two possible actions when an unwanted packet arrives --
DROP it, or respond with
REJECT. Rejection can take the form of an
RST flag in a TCP return packet, or an ICMP "port unreachable" message. Either way, explicit rejection leaks information about your network configuration. At the same time,
DROP can be caused by network congestion, so the remote end may retry. So for your "friends" (legitimate communication partners), it is preferred to REJECT, while for random port scans it is definitely preferred to DROP. And your firewall is not telling you which it is doing.