How to view inbound traffic source? I have massive traffic 95% incoming but the source is me and it's external.

Boy I hate these new forums and the layout but oh well, finally created an account.

Anyhow, recently (over the past few days) when my Web Protection -> Web Filtering module is turned on I see massive influx of traffic (not all the time, maybe once a day).  The traffic is constant and 95% of the bandwidth.  I can't determine destination and the source is either AKAMAI or my own IP.  

Once I turn off Web Protection, the traffic stops.   I can turn it back again and everything will be normal...until it happens again few hours later.  What could be causing this and how do I determine the real destination of the traffic or the real source?

On the Top Applications Tab I can see "HTTP 20gb"

Then I go sort by User and no users accrued 20gb not even close (At most 750mb).