I imagine 98% of the data you serve is stuff that was uploaded in the past 48 hours?
Also I don’t think social media persistence has huge value to the user? It’s mostly downside.
Data out spikes might be headless clients or some kind of automated scraper that someone is using? Exposure to this is also a vulnerability you have.