Port 53 traffic to Fortiguard even after disabling?

I have set my boxes to communicate to Fortiguard over port 8888, and all DNS server settings are set to internal DNS servers. I am still seeing requests outbound on port 53 to what appear to be Fortiguard servers from my Fortigate devices. Is anyone else seeing similar traffic?

I'm blocking outbound DNS except from approved servers, so it's constantly showing up on DNS reports as something to look into. The traffic is being blocked, and Fortiguard services are working correctly- so it's not actually causing a problem anywhere, just annoying. I'm wondering if anyone else noticed this before I submit a ticket. i'm running 5.4.5