If most traffic is inbound, I would say Carey does not have any filesharing issues, but auto update issues: the IP addresses most accessed are mostly for CDN providers, the ones used for hosting update packages. Auto updates will take a lot of traffic, especially snaps. They take a lot of space, and usually when one is updated because of a library issue, you can count on several others having the same library to release updates too.
If most of this traffic is outbound, then we have a different history and something is really sending a lot of data outside. And if the traffic is more or less balanced, it's a proxy, torrent, or Tor node running.
How to know? There are some programs for that: iftop, iptraf, nethogs and bmon are easy to use and powerful.