(cell) means he's using his cellular and not wifi.
Some of the connections looks like it's connected to an Apple account (iCloud mail?).
Right - he's got a secure email connection (SSL IMAP port 993) to an Apple server (17.142.167.11).
As previously mentioned, these are all TCP/IP connections - both IPv4 and IPv6. The phone's status line shows data is currently being supplied by an AT&T LTE connection. There is no current Wi-Fi connection.
AT&T is doing Network Address Translation (NAT) on the IPv4 connections, which is why the local IP address is shown as 10.x.x.x, which is non-routable. I believe the "(cell)" tag is meant to warn you that this is private address space managed by the carrier, as it only appears next to the 10.x.x.x addresses.
OP - doing a "whois" on the remote host, and googling the remote port number, should tell you everything you want to know. You can do whois searches right from the ARIN site (upper right hand corner), if you don't have a preferred site or tool of your own:
https://www.arin.net/