It sounds like #nethogs is being inaccurate in its reporting. Gzip has no networking capabilities of its own. So to say gzip is making a connection is close to nonsensical

Can you set nethogs to show you the exact command that is causing the offending traffic. It may be something pulling from then net and piping through gzip
Or it might ne logs on a network share in which case Samba of NFS is really doing the network connection.

Long story short I'll be very hard to access this situation without knowing the actual command that is causing the Traffic

Nedxt time you see this happening it'd be helpful if you could quickly in another terminal run

ps -afx >> Running.log

Then examine Running.log to see if it containes the offending gzip command. And if so attach Running.log to this BR

If the output of ps does not contain a reference to gzip, then either you were a little to slow and the gzip comand finished before you had a chance to run ps, Or nethogs is way off on what it is reporting.

Also please be sure that this is an actual network connection not just IPC via the LO interface.

Futhter information that would be useful:

To and From IP addresses of the connection
The acutal command causing the connection (see above)
Steps to recreate the event