Running netstat and analyzing my established connections I noticed sometimes tor talks to other IPs that aren't my guard node. I'm not sure if this is supposed to happen because I very very new to this. At first I thought this could be my tor choosing it's relays but not sure if this' how it works. I want to know if this is expected. I searched for info about this IPs. Some of them are labeled as "tor related" or are exit nodes, others are not. I remember most of them being from Germany, which leads me to another question.
Why are there so many German relays? Sometimes all my three relays happen to be from Germany. I heard about end-to-end attacks but don't know if this is the case.
Im not posting the ips. My browser's GPG were verified.