If OSQuery is configured correctly, it makes connection (as a client) to tls server periodically. So its the osquery which initiates connection. This is due to most of the firewall configurations are to deny incoming connections not the outgoing one.