There are lots of logs about "Root.certificated.url"

Hi

in our network with 1400 endpoints, we have lots of log records with "Root.certificated.url" that have connected to mant IP in internet.

 i would like to know how can i find which applications in endpoint create these logs, is there any further information that can i find in our forti analyzer or fortigate dashboards.

Regards,

Mahdi