Looking at the connections (netstat -a) every time Whonix starts, it connects to tor.sabotage.org (https), detained.net (https), and zinc.v-yu.com (pop3s). What are these? Furthermore, why does it connect to a pop3s
Your Tor entry guards? Check.
It most likely doesn’t connect to pop. But to the port that is mostly used by pop and therefore labeled pop. To my knowledge, netstat doesn’t probe the actual protocol.
Most used Tor server’s ports are 80 and 443. When these servers (such as https://v-yu.com/) are using these already for a usual web server, Tor servers can also provide any other port as their incoming Tor service port.