We've determined the connections are for fetching signed lists of certificate transparency logs for apps with certificate transparency enabled. The downloads are done via DownloadManager so it gets attributed to the shared media UID as with anything using DownloadManager. It's set to only download while charging so that's why it only happens while charging and will trigger as soon as the device starts charging if it was already queued up. These are the files it downloads via regular HTTPS GET connections:
https://www.gstatic.com/android/certificate_transparency/v2/log_list.json
https://www.gstatic.com/android/certificate_transparency/v2/log_list.sig
https://www.gstatic.com/android/certificate_transparency/v3/log_list.ctfb
https://www.gstatic.com/android/certificate_transparency/v3/log_list.sig
https://www.gstatic.com/android/certificate_transparency/log_list.pub
Android 16 introduced certificate transparency enforcement for apps opting into it, but nearly nothing opts into it at the moment. Android 17 changed it to opt-out instead of opt-in so it's going to be near universal now including for the OS components which are already mostly targeting 17 other than bundled apps which aren't updated to it yet.
We've made our own certificate transparency log list download service as a caching reverse proxy for now and we'll integrate it into the next GrapheneOS release.