There are a bunch of possible reasons. SSL needs to be negotiated for every connection. When HTTP/2 is not being used browsers will open up to 6 parallel connections to each domain to get more parallelism. When HTTP/2 is being used that largely collapses down to 1 though there are still cases where a separate connection will be used for non-credentialed (anonymous) requests (fonts are the most common case though it’s possible that images referenced from css could fall into that bucket).
What is your grade for “Keep-alive Enabled”? Keep alive keeps connections open so that the browser doesn’t close the connection and open a new one for the next resource on the same domain.