@MHulley Firstly, apologies for the delay in responding here and any inconvenience this issue may have caused.
From the description, you are using the metrics to determine 4.5 GiB is sent ever 15 minutes, so either something on the server is changing those files or there may be a permission change and we're syncing . The metrics will show the full file was synced but we're really just updating the metadata
I would recommend looking at the Event ID 9102 and 9302 events on the server to monitor sync progress
How do I monitor sync health?: https://learn.microsoft.com/en-us/azure/storage/files/storage-sync-files-troubleshoot?tabs=server%2Cazure-portal#broken-sync
How do I monitor the progress of a current sync session?
If you are seeing a high amount of sync traffic and they didn't make ACL changes or modify a large number of files, I would use a tool like process explorer to monitor file system activity: https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
Hope this helps!
Kindly let us know if the above helps or you need further assistance on this issue.
Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.