Thanks for the ideas
Bit more info - I am using IE6, and already have spoofstick installed, so I know i am not going to any phishing or false pages.
The ISP uses a normal transparent proxy, but you normally don't see that in the TCP/VIEW.
One worrying thing is that some of the connections are when i am accessing a site like paypal with https.
Have double checked everything with AV, Spybot and hijack this, nothing found.