For Acrobat Reader DC (in default profile) I've got a "deny all outgoing connections" - however, I noticed that when Acrobat starts, a blank window pops up, and acrobat becomes unresponsive. When I also block "Deny outgoing connections via RdrCEF", the problem goes away. However, the latter rule shows as redundant, when clearly it is not.
Edit: I now had to add a 3rd rule deny "Adobe Acrobat Reader DC via AdobeResourceSynchronizer" in order for the blank page to not appear. Again, I only found this by turning off the filter, observing connections, and then blocking it. Again, it's a 'covered rule'.
My best guess is that the initial deny all rule only applies to:
/Applications/Adobe Acrobat Reader DC.app
While it doesn't actually cover these two applications:
/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AcroCEF/RdrCEF.app/Contents/MacOS/RdrCEF
/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AdobeResourceSynchronizer.app/Contents/MacOS/AdobeResourceSynchronizer
That would point towards a problem in LS4, which doesn't identify the 'via' connections appropriately?