I think I figured out some idea about what is going on. Our home drives are mounted on a central server and the network activity was between my computer and that server. Looking at a packet dump shows continued attempts to read .config/pulse and .pulse-cookie. Something, presumably NoMachine, continually tries to do something with these files. I think unchecked “Use sound notifications when there is an event” and “Enable audio streaming and microphone forwarding”. Presumably only the first one needed to be unchecked, but after restarting the server, connecting and disconnecting, polkitd continues to have small memory footprint, uses no CPU, and the continuous network traffic is no longer there.