Blocked traffic that sometimes gets allowed?

[securvark]

There's something in my rules that's wrong, but I can't figure out what exactly. Maybe someone can help me out, I'd greatly appreciate it!

Here's what I see in my logs:

May 26 09:40:31 	► WAN 	let out anything IPv4 from firewall host itself (1000008963) 	192.168.1.106:55615		52.26.206.149:443		TCP:S
May 26 09:40:31 	LAN 	Default block LAN net (all allows above this one!) (1527184618) 	192.168.1.106:55614		52.26.206.149:443		TCP:PA
May 26 09:39:59 	► WAN 	let out anything IPv4 from firewall host itself (1000008963) 	192.168.1.106:55614		52.26.206.149:443		TCP:S
May 26 09:39:59 	LAN 	Default block LAN net (all allows above this one!) (1527184618) 	192.168.1.106:55613		52.26.206.149:443		TCP:PA
May 26 09:39:29 	► WAN 	let out anything IPv4 from firewall host itself (1000008963) 	192.168.1.106:55613		52.26.206.149:443		TCP:S

Several things I don't understand here:
52.26.206.149 is an AWS IP that I have allowed (and verified its on the list). The allow rule is not called 'let out anything IPv4 from firewall host itself (1000008963)', I don't actually see that rule so I think its a hidden pfsense default rule?
The allow rule allows 443 TCP/UDP, any type, to go out. So why is one packet getting blocked and another getting allowed?

Not sure what is the best way to share rulesets, but here's 2 screenshots. Under floating there is one rule to reject all ipv6 traffic. No other rules under other interfaces except the default bogon/private under WAN.

Thanks in advance!