The Cloud module owns the nRF Cloud connection. It runs the CoAP/DTLS session from the host MCU using the nRF Cloud CoAP library, sends device messages, polls the device shadow, and resolves Wi-Fi® based location requests. Cellular data passes through the Serial Modem over PPP, but the security session terminates on the host.
The module never decides on its own when to connect. It connects when the application requests it.