I run filemon myself and found that the calls to these directories do not read data, but rather indexing like calls. Since you can not conclude from the seek to the content it is unlikely that they are actually caused by EQ to spy us.
They are highly correlated with the minipatcher for the real patcher, so my guess is that the small window looking for patcher updates uses some IE API calls, which in turn do regular checks of the IE cache, etc.
