Short answer: You're flows are identifying any traffic to any google operated servers on the internet.
What quack's link is saying is that every google owned IP address resolves to the 1e100.net domain.
$ dig +short www.google.com
$ dig +short -x 18.104.22.168
Your question as to what is causing this - with the information you've provided it can be anything that contacts google servers.
Just about every web page has google analytics installed, gmail, google search, google appengine, blogspot, and google compute are all services operated by google, and some of them are running software installed by anyone (blogspot, appengine, compute).
Giving us 1e100.net is equivalent to saying I noticed something on my network contacting the internet, and the internet is suspicious. Can you help me figure out what it is? Not with the info you provided.
If you want to trap it - turn off outbound 80 & 443, install squid (transparent, SSL MITM), and watch what systems are actually doing.
Another quicker and more labor intensive way is to watch your DNS requests. Start to track what Domain Names (host names) the systems are calling, and map them to the IPs that reverse lookup to the *.1e100.net you're curious about.
but not random, its often the previous ip + 1
That's how systems use DNS results that have more than one IP for the host name. See my previous DNS query for google.com - there were 5 IPs returned and my system will use the first one, then the second, then the third, then .. you get the point.