I have been having problems with Comodo Firewall and svchost.exe recently. Comodo was throwing up about 20 popups which all needed clicking on to allow. On visiting their forums I found this answer
Actual application rule settings to eliminate the issue:

Application: C:\windows\system32\spoolsv.exe - you need to browse for it, it won't let you type it
Parent:C:\windows\system32\services.exe - ditto
Action: allow
ProtocoL: TCP
Direction: Out
Destination IP: Any
Destination Port: 3396
Miscellaneous: Skip advanced security checks, Allow invisible connections

It seems to have worked for me and I post this for members who might get the same problem

Mod Edit: Topic moved to more appropriate forum~ TMacK

That would seem to me to be a not very safe rule. It's allowing spooling to go out anywhere, any IP address. Can't it be limited to the trusted network? I'm not familiar with how Comodo works (browsing for exe name is as it should be though), but I would think limiting a totally open outgoing spooling would not be something I'd want to do. SVCHOST does need to act as a server of sorts but not all over the internet. Just my opinion