Seeing it on your PC
A listener on 3389 means Remote Desktop is turned on (Settings, System, Remote Desktop). An outgoing 3389 is you, or something on your PC, connecting to another machine.
Should you block it?
Never forward 3389 from your router to the internet. Exposed Remote Desktop is one of the most common ways ransomware gets in, through guessed passwords and flaws such as BlueKeep. Use a VPN, or a remote-access tool that does not open a port, and keep Network Level Authentication on.
Check it on your PC
Run this in PowerShell to see what is using port 3389 right now, and which program owns it:
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}Get-NetUDPEndpoint -LocalPort 3389 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.
Block it in Windows Firewall
In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.
New-NetFirewallRule -DisplayName "Block inbound TCP 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block
New-NetFirewallRule -DisplayName "Block inbound UDP 3389" -Direction Inbound -Protocol UDP -LocalPort 3389 -Action Block
Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.