Found it.
In iptables, this was doing it:
-A OUTPUT -p tcp -m tcp –dport 443 -j DNAT –to-destination [SNIPPED]:443
On a non-multisite 4.7.2 build it half works. It gives a false report that my site can communicate securely with wordpress.org when I know it cannot.