How would you investigate this ? Tor node communication to device in internal network

Defender for Endpoint detected communications from a Tor node to a device within the internal network. The user did not use Tor, nor is Tor installed on their PC. Interestingly, Advanced Hunting only shows an ‘InboundConnectionAcknowledged’ on LocalPort 64441 from an unknown process, indicating no initiated communication by the computer. However, the firewall logs show the Tor node as the destination, which is the reverse of what is observed in Microsoft Defender for Endpoint. Looking at the device timeline, there isn't anything strange prior to the event.