How does the web content filter work, does it download the blacklist locally or does it do a lookup each time we access a new url?

My understanding is that its a lookup each time you access a new url, and it maintains a cache of entries that are checked regularly as well.

Yes, it queries the remote database as it's huge.