/shrug. Its been a while since I last rebooted and I have it open to the network. Im allowing inbound connetions so people are probably using the node to do the IBD.
Discussion
I also have tor and i2p connetions open. I2p can be a data suck without people actively using it a bunch. between that and allowing inbound connections. It's the only reason I can think of having such a high amount of data used.