Probably apple telemetry. At least some of the phoning home is done using apple.com as a domain so it can add up very quickly. If anything I'm surprised the top domains aren't just telemetry endpoints, but I guess telemetry is a good use case for bare IPs so it doesn't show up as much on DNS analytics.