vmnet-natd is the VMware NAT daemon that serves the private "vmnet8" VMware virtual switch by default. It is a "proxy" between the host TCP/IP stack and the virtual machines connected to vmnet8.
As a result, it opens a raw ICMP socket on the Mac OS host TCP/IP stack to receive any responses to ping requests going out from VMs connected to vmnet8.
The brief "connections" you are seeing are probably ICMP messages that the vmnet-natd daemon picks up, figures out that they are not in respose to any outgoing ping request, and ignores them.
Open System Preferences; Sharing; Firewall; Unlock pane; Advanced; check Enable Stealth Mode. If you don't want to be pinged from the internet.
They are harmless and you can safely ignore them. That is unless it is a security concern for you, in which case, we can probably figure out how to make vmnet-natd not open a ICMP raw socket until at least one VM is powered on and connected to vmnet8.