I believe pdfs can load remote images, which pings a server. There are other reasons, I haven’t got sufficient knowledge. Some pdf readers will offer a sandboxed mode improving security. I think zathura has this for instance.