The connections in the first screenshot[0] aren't necessarily from Microsoft. This screenshot shows a DNS lookup for google-analytics.com followed by an attempt to use Teredo. If Chrome is installed then this could be from the Google Update service. It seems unlikely that Microsoft would send usage information to a Google site.
I saw that tweet but I still doubt that any Windows 10 service would connect to analytics.google.com. It seems more likely that he has a Google application installed.
Doesn't have to be a user installed google app. Google analytics use is ubiquitous for mobile and web apps could easily be something Microsoft bundled into their os like for example candy crush (not implying that's the culprit) or something that carries over that pervasive track every click and mousemove type mentality.
Wouldn't it be better to log that traffic from outside of the client? There's nothing that prevents Windows/Process Monitor from hiding this traffic from an application.
[0] https://twitter.com/m8urnett/status/866353982217699328
Edited to omit needless words