I will take this opportunity to remind you that it is for this reason that our endpoint icons are triangles. If the pointy end is connected to the network, this is a source of data and network traffic, such as a file server. If the flat end is connected to the network, it is a sink of data.
There is a third possibility: that the identified endpoint is being remotely accessed for legitimate purposes. I would counter that if you have a network with any sensible level of restrictive policy, chances are that you're not allowing remote access to ordinary desktops.