How do I find which IP address softwareupdated daemon is downloading Mojave from?
lsof doesn't always show the root processes running. So sudo to be used. 

sudo lsof -p PID | grep TCP 

PID to be replaced with the PID(Activity Monitor is one source.). TCP can be replaced with other protocols too. For unfiltered results removed the | grep TCP part.