Hi WuhKuh,
these are IP addresses of avast servers used for SecureDNS feature. SecureDNS (encrypted DNS queries) is available on AIS and Premier as a separate shield + on all version inside SafeZone browser.
The communication you might see is the SecureDNS handshake an initial part of the service setup, where we connect to every server enabled for the service at the moment (the list is dynamic) and find the one that is closest to you (network wise - meaning that it might be geographically pretty far).
The protocol used is the opensourced DnsCrypt (used e.g. by OpenDNS as well), you can update your IPS to check for DnsCrypt on ports 53 and 443. Would you rather prefer these to be moved to other ports, since you have troubles seeing encrypted DNS traffic on port 53? The traffic is encrypted and is used to provide tamper resistent DNS queries - something DNSSEC fails to provide for most of the domains at this moment.
Cheers,
Lukas.