Why does Google Play Services does make VNC connections? today I did had fun with Netstat on my device and saw that Google Play Services are making VNC connections from my device to a Google server.

The question here is : why ? Sounds to me like a backdoor allowing Google to see whatever I do, that's really scary...
I just decompiled the SockStat apk and found this:

.class Lcom/powl1/sockstat/Utils$1;
.super Ljava/util/HashMap;
.source "Utils.java"
#
#
#skipped lines
#
#
const/16 v4, 0x146c #Register v4 is assigned as 0x146c (Hex equivalent of 5228)
#
#skipped lines
#
.line 161 # A HashMap might have been used to map port 5228 to "VNC"
    invoke-static {v4}, Ljava/lang/Integer;-&gt;valueOf(I)Ljava/lang/Integer;

    move-result-object v0

    const-string v1, "VNC"

    invoke-virtual {p0, v0, v1}, Lcom/powl1/sockstat/Utils$1;-&gt;put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;


What this means is that as @Izzy pointed out, the developer might have incorrectly labelled port 5228 as "VNC"..

Contact the developer to solve this issue ;)