I am using Sygate personal firewall and very often, on starting my system, I’ll be told:
It isn’t always Windows Logon though - all kinds of applications seem to do it - my AV program, my printer software, Microsoft Office and so on (always to the same IP address)
That IP address is a reserved address for this particular use… I don’t know why it should show up as being from random applications rather than the OS itself, but it isn’t dangerous at all.