4G extreme network traffic

I have a network traffic problem.
At my cabin I have a TP-Link TL-MR150 4G router, FW updated in september.
It’s a fairly simple HA installation, using cloudflared for remote access.
It all works very well, but:
The 4G network traffic is over the top. All the time. It will get close to 13GB in december, and I haven’t even been there. There are no web based services, everything is local, just a few temperature and lighting automations.

  • The Cloudflare dashboard says that the total bandwidth, last 30 days, is 736MB. Makes sense.
  • The TL-MR150 integration in HA says 9740MB in december.
  • My 4G ISP says I’ve used 10GB in december.

Could it be a NAT Loopback problem? My TL-MR150 doesn’t have NAT loopback functionality, I think (which is surprising and silly for a 4G router).
I’m very confused!
Experts, please: What is wrong?

Have you checked nobody is hijacking your router.

A valid and good question, since it seems like almost all the traffic is coming and going outside of cloudflare!
The cabin is 200 meters from the nearest house, so I don’t think any outsiders are connected to it.
When I try to ping the router’s public ip address, I get the response “Destination net unreachable”.
If I ping the domain name, I get replies from cloudflare, as I should.
How can I check if it’s being hijacked?

If your router can provide detailed logs, check them to see what traffic goes through to the airwaves.

Also if you can check if there are specific time windows traffic might spike.