SQL will use memory from outside of the buffer pool, things like CLR for example use additional memory, so even though it is capped, it can go over by usually 2GB depending on the RAM needed.

I would recommend reading Chapter 4 of the Accidental DBA guide (link in my signature) which goes into memory management.