The first call to "dpm.demdex.net" is call for the Marketing Cloud ID Service implementation or Audience Manager integration.
The check needed here is whether the app has analytics implemented through Mobile Services UI configuration. If so, the call to "assets.adobedtm.com" for fetching messages (In-App or Push) configuration is quite expected.
That seems to be the case and mostly "assets.adobedtm.com" in case of mobile apps is from Mobile Services UI. However, without validating the actual app and calls, I might not be able to confirm exact scenario.