I was running Wireshark and noticed that my machine sends IMAP requests to 220.127.116.11, which, according to my TorBrowser, is the entry node I'm connected to. Likewise, my machine seems to be receiving IMAP responses from that IP as well. The responses seem to often happen in as low as ~30ms from the request. When I ping the entry node, the latency seems to be ~31ms. This leads me to believe that whatever requests my machine is sending, it is the entry node that is responding to them.
I installed another copy of TorBrowser, using a different entry node, and that doesn't seem to have the same problem. Also, when I'm not running a TorBrowser, there is no problem. The data that is being sent and received does not seem to be plain text either, so I don't think this is actual email traffic.
Does anyone know what is going on? I don't think I have any email services running in the background. Even if I did, why would the entry node respond to the requests? Is it possible that the 18.104.22.168 (and one of my copies of TorBrowser) is compromised? Or is IMAP (or IMAP looking) traffic normal for Tor behaviour?