'the_posts' is an action fired everytime WP_Query get posts, for main query and for other secondary queries, so when you do something like:
$foo = new WP_Query($args);
in a widget or elsewhere (shortcode, related posts…) 'the_posts' is triggered again.
However there is only one main query, so you can use a conditional and do what you do only if the query that trigger the action is the main.
Luckily 'the_posts' pass to hooked functions the query object so you can check if is the main using WP_Query::is_main_query() method:
add_action('the_posts', 'check_my_endpoint', 10, 2);
function check_my_endpoint( $posts, $wp_query ) {
if ( $wp_query->is_main_query() ) {
global $wpdb, $cardcomm; // no need to globalize $wp_query, we have a reference to it
if( isset( $wp_query->query_vars[cardcomendpoint]) ) { ... }
}
}