Operating systems try DNS servers in order, so 8.8.4.4 is normally only queried when 8.8.8.8 times out. Like its sibling it is anycast from Google data centres worldwide and geolocates to Mountain View.
Seeing traffic to 8.8.4.4 in a firewall log almost always means a device has Google DNS configured manually, or an app (some smart TVs and IoT devices) hard-codes it and ignores your router's resolver.