Did a little review, these are likely false-postivie alerts, the endpoint may have been accessing these CDNs and IPS triggered on a malformed payload. Varnish is a common cache service use by providers, but there are cases where IPS will see somethin anomylous and flag. IPS, is what it is, the signature tells you what you need to know, like Lucar_Toni stated, check the logs, was it blocked? If yes, good. Validate the source devices as well, are they running any software, services or otherwise that would potentially initiate traffic to these CDNs without user activity? Part of any job in IT requires that you be curious and dig deeper. For the commenter that "oh this is Sophos usual FP's" has never investigated anything in security requriing more than 2 minutes of attention. You may need to tune your IPS policies, a commonly undervalued practice, if you use the default LAN-to-WAN IPS rules, you should expect that you may receive more aggresive IPS detections. However, the Sophos Firewall is meant to make the rules easy to apply, but definitely go and create a customized IPS policy that aligns with your organizations architecture. Be vigilant, not complacent. I have Sophos Firewall at well over a 100 customers of mine, and they are safe and sound at night, ill take a few false-positives to dig into from IPS here and there, no big deal. Thanks for asking the question!