That's down to the name resolution done by IP 192.168.1.1, possibly your router. The two A records returned are 188.8.131.52 and 184.108.40.206 and neither of them seem to have much to do with the name "WORKGOUP" which comes from the default workgroup for a non-domain windows machine.
Wireshark shows the subsequent SYN requests with destination "WORKGROUP" due to the A records returned by the preceding DNS queries populating the name cache.
The IP addresses returned from the query are due to the user's ISP hijacking dns queries for unknown hosts. TimeWarner / RoadRunner dumbness.