i remeber disabling the network activity ping before, and in my case i did it with setting
/etc/NetworkManager/conf.d/20-connectivity.conf
[connectivity]
enabled=false
now with the rest of my findings;
i did run;
# grep -rl 'example.org' /etc
/etc/named.conf
/etc/lynis/default.prf
/etc/clamav-unofficial-sigs/user.conf
/etc/clamav-unofficial-sigs/master.conf
/etc/named.conf is apparently configuration file for BIND - DNS which has *arpa, example.com references. BIND - ArchWiki
it is part of bind package and has service named.service, see whether this is running. you might have inadvertantly running a local DNS server.