So I tried to isolate which PC was using the bandwidth, and basically shut them all down, and its still a problem. I have disabled the VPN and FTP, and constant download spikes continue all day.
This has gone on for 2 months, but the weird thing is sometimes it starts at 8 am and goes until 4:30pm, other times its 24 hours a day.
The server has no exchange on it, only Microsoft Dynamics and the network has 10PCs and 8 VPNs and a server 2012 terminal server (which I have shut down, and downloading continued).
Whats the best way to determine the culprit? I have included a file showing the ISPs monitoring of the usage.