cannot explain occasional large incrementals on file server

[rebooter]

I'm doing volume backups with CBT and deduping of a Server 2019 file server and see incrementals jump significantly.
https://imgur.com/a/62ISOrB

For example, between 6:08 AM and 7:58 AM it jumped 12gb, before our work day starts.

Then at 8:39 PM after everyone's gone home, it jumps almost 19gb.

There's no native de-duplication running on this server nor is the server being used to store backups. Microsoft Defender is the A/V.

On Sunday at 12:11 PM, it jumped 42gb but nobody was working that day.

Note my full backups are under 500gb so this isn't a big file server.

Any ideas?

[Gostev]

It's truly impossible to guess... all you can be sure about is, some app on that server (or the OS itself) is physically changing content of a whole lot of disk blocks even on the days when nobody is working. You could try Sysinternals tools to capture a log of all file system activity on those quiet days and analyze it.

[rebooter]

Oops, it appears shadow copies were in fact enabled on this server. I had thought that was turned off due to issues we had, but sure enough the shadow copy times correlate to some of the spikes I have seen: 7:10 AM and 12:11 PM.

I may need to disable that or limit what volumes it copies because we are consistently running out of storage.

Funny, I read several threads before posting but missed any mention of shadow copy being turned on with a file server.

Hopefully my post will assist others who make my mistake.

[rebooter]

Correction: Disabling shadow copies on the server made no difference. So whatever is causing incrementals to jump from 200mb to 16gb in one hour remains a mystery.