Apparently a local WordPress will “phone home” during installation, and this is how the incoming links section is populated. I found some instructions on how to disable that behavior in this post:
https://www.456bereastreet.com/archive/201102/improving_wordpress_privacy/
There’s also some more detailed information about data collected by WordPress over here:
https://lynnepope.net/wordpress-privacy
