It periodically (re)resolves hostnames contained in aliases so you can have filter rules which are not tied to a specific IP (or in the case of one using google.com, it could be many IPs)
Do not disable mwexec. It does many, many, many things for the system.
And keep tracking the latest snapshots for potential fixes.