I have several cheap chinese cameras (Sricam) in a separated VLAN without internet access in my home LAN.
The camera are connected via ONVIF to a Raspberry running [motion](https://motion-project.github.io/).
My camera server is in a separate VLAN and the traffic from cameras pass through a FW to reach it. The cameras cannot reach internet or any other hosts inside my home network.
According to the logs on the FW, my cameras are beaconing in China through DNS.
Many seccam have IRC beaconing of which your gateway should be firewalling off.