Mine does the same thing. So it's not a virus or anything. I'm sure there's a reason for it, but don't know what off hand. Maybe cause it's good for the health of the network.
Sorry but don't know about GhostSurf. Maybe someone else does.
Try running
PeerGuardian 2(PG2) while using LW. It works like a mini firewall to block unwanted ip's from viewing your p2p activities.