Why is svchost.exe showing up in Symantec Endpoint Protection as a threat from local server hitting a local web server nonstop?

I'm having a problem where I have a local server machine that shouldn't have anything to do with our local web server, but yet the web server's Symantec Endpoint protection is showing the local server (IP) is constantly hitting the web server and being blocked. The application is showing as svchost.exe. Getting a new log entry ever few seconds.