Does macOS retain data of a signed out iCloud account removing all data and signing into another one?
I got a new work MacBook about six months ago. When I first set it up, I signed into my personal iCloud account. Then I signed out of that account and made sure to check every single box of all the data that it said it would remove from the Mac after signing out. Contacts, reminders, notes, Safari browsing data, passwords, Keychain data, etc. Then I signed into the iCloud account for my company and work.
Fast forward to today, after rebooting my MacBook, and upon startup while I was using Charles Proxy to inspect other web data, I saw a bunch of HTTP requests to websites that are all in the Passwords app for my personal iCloud account. I did not have SSL proxying for every single website (I only really have it turned on for my company's websites) so I could not see the response payloads for each request. I could only see the URL being requested for more than 50 different sites that would 100% implicate a unique fingerprint from the Passwords app of my personal iCloud account. There's no way in the world that my work account would have any of those websites. I tried rebooting the MacBook again multiple times to see if those requests would be repeated on startup and also so I could inspect the response payloads with SSL proxying turned on to see why exactly are these requests being fired in the first place, but it never happened again and I could not reproduce that issue.
On top of that, when I open up Spotlight and search for contacts from my personal iCloud account, it still shows results for those contacts. When I click on them, no information shows up. Spotlight just shows a blank UI after tapping on it.
Question 1: despite macOS telling users that it will remove all contacts, notes, reminders, Safari, browsing data, etc. when you check all the boxes during sign out of an iCloud account, macOS still retains much of that data deep in the operating system?
Question 2: if macOS is retaining all my passwords from the Passwords app, even after signing out of my personal iCloud account on this MacBook, why does it need to make a bunch of HTTP requests to these sites at all?
Knowing the answer to these two questions would let me pinpoint if this leak in privacy is due to the internal working mechanisms of macOS or not. If not, then I have to start considering if I have a keylogger or malware or something installed on my MacBook without my knowledge.
MacBook Pro (M4)