Why is my computer making hundreds of requests to captive.apple.com?

Solution 1:

I analysed the traffic with tcpdump -k port 53 (suggested by this Reddit thread), and it turns out it was expressvpnd, part of Express VPN.

That was surprising, because I didn't have Express VPN client running, but it appears to set up a demon that sends DNS queries to captive.apple.com and www.mb6gpu84.com even when the app is not running.

I removed expressvpnd and killed the process, and the requests stopped.