[Security Discussion] bigeasy911:
First have you gone to main setting>wifi>setting button>advanced>scanning always available and make sure its disabled. This is one of those crappy things google.just cant help.itself.not slipping i the and tries to cover it with goog.intentions which are questionable. It purposely buries it way down in setting even those that want to be sure its off may have trouble finding. Also if you look at.the wording its supposedly there to help other apps have your location but also adds "and for other purposes". Which in legaleeze means wide open and to google means we are going to log all the info we can to use for our profit.

Anyways make sure that is off first and formost. After that I will include someother info below to consider and just some FYI stuff you may or maynot be interested in.

I dont know what apks.you have loaded but I know if you have gapps installed there is a number of call home features built into it and if anyone knows how to.bypass things in android its google dev team. It is for this reason i deal.with the inconvenience of not having gapps. Choosing instead to side load or use fdroid and other alternatives for googles various apps. I duckduckgo for searchs. Privacy apk if I wanted to tweet or FB. Email I use a paid service but there are a jumber of free that do not log. I also keep things local and sync it with my pc so nothing is left on servers. You can even setup cloud storage in a way where it acts as a virtual drive and everyrhi g is encrypted while on the cloud but decrypts locally on the device so its seemless.on the users end.

Secondly even without any of these sort.of apps installed google has built in a quasi call back function into the kernel. Its main use is to identify when a data network connection is behind a captive.portal. The setting not accessable from the UI is global captive portal. Its what is the cause of the ! you may sometimes see on the signal bar animaton. Android gives you an option to disable it thru a terminal windohus by changing captive_portal_enable setting from 1 to 0. But interestingly enough its been found that even when set to disabled the system will still use the global captive portal entry regardless. Its setting is to client3.google.com IIRC.

The other issue is that if you have disabled captive portal you will lose the ability to save the config in wireless networks for any network that does not broadcast its ssid or any that is a captive portal which are basically all the commerical wifi such as starbucks book stores libraries etc.. See goggle wants all that info so they can map the worlds wifi network aps (you can now see one way they have found to use this with their up coming release of cellular service where one of its main features is to auto offload both data and calls to any open wifis it has access as they come in range. Thus dumpings its costs and load to.those other companies offering free wifi to its customers and the community)

Interestingly it only does this to wifi not cellular data even though it scans and indicates both with the "!".

The way to stop this is either change the global captive portal to loopback i.e. 127.0.0.0 or you can host a basic webpage your device.

You can do the same for the ntp service as well as it too calls out automatically regardless of.settings in the UI.

The other possibility of the location leak could be from someother app you may not have disabled network or location from that has a call home feature.

You could put a network scanner and log what ip and then see based on its owner to figure out the program.

Another idea is to run a firewall and creat a script to stop all of this kind of leaks. I would recommend AF+Wall.