High bandwidth usage but only showing on External if

I noticed our internet pipe was maxed out on the downstream, so I logged into the UTM and noticed the External interface was pegged, but there was little activity on all the other interfaces.  The traffic was tagged with the "Akamai" application name over port 80.  Does Up2Date use Akamai for content delivery?  I'm trying to figure out where the traffic originated since all of our internal interfaces were twiddling their thumbs while only the External interface was being hammered.  It looks like, according to the flow monitor, that the traffic is originating from the UTM itself.