Read this. And this. Your phone will make connections to GrapheneOS servers to check for apps and system updates, sync the time, update location database, etc.
Half the world's servers run in Germany. Don't immediately assume it's malicious traffic. If you've reset the phone and, when turning on the phone, the correct hash for your device is shown, then there's nothing malicious on your phone.
Also don't block the servers if they are GrapheneOS servers! You can turn them off in settings (again, read the links I put), if you are blocking the servers you are just blocking the phone from getting (potentially important security) updates. Instead, you can make it only check for updates when told to, instead of automatically.