As far as I understand the screenshot, the traffic is from Pro Tools itself, not the Application Manager. And two Megabyte is
far more than a simple request for update information, there is a substantial - unexplained and unapproved - amount of information transmitted to some servers. It would be helpful to actually learn the remote IP addresses and other details where this traffic is going to.
FWIW, I cannot reproduce this with PT 12.4 on Windows 7. I'm seeing a quick TCP session to a nearby Akamai CDN node webserver, probably an update check. Kudos to Avid for actually doing this via IPv6.
A subsequent PT start doesn't even show this one, probably as PT remembered it did recently check for an update.