The rapid drop is curious. It's a 3 second span in which 35mb is dropped. Given that CPU is almost zero, it's all I/O (address processing). The addresses are not serialized to disk until shutdown, so the holdup is just the processing of the addresses on the network strand (single in-memory pool, so unlike the blockchain store, no concurrency). This is a pretty extreme setup, with 1000 connections being held with up to 100,000 being concurrently attempted, and it takes 5 minutes to clear their work. For a typical node startup, the 10 connections are established and addresses cleared 4 secs from process start.