windows server 2016 paged/nonpaged pool leak

windows server 2016，memory 16G，usage 90%+，but can not find the process who consumes the memory.

1、rammap

we find nonpaged pool takes 9G memory，paged pool takes 4G。

2、poolmon

nonpaged pool : the most consumer's tag is "File"，the *.sys listed below are base on search by tag "File".

Filename

---

acpi.sys

acpiex.sys

afd.sys

ahcache.sys

appid.sys

applockerfltr.sys

AppVStrm.sys

AppvVemgr.sys

AppvVfs.sys

asyncmac.sys

BasicRender.sys

bowser.sys

bxois.sys

cdfs.sys

cht4dx64.sys

cht4vx64.sys

Classpnp.sys

clfs.sys

ClipSp.sys

cng.sys

condrv.sys

crashdmp.sys

csc.sys

dam.sys

dfsc.sys

drmk.sys

dxgkrnl.sys

dxgmms1.sys

dxgmms2.sys

e1i63x64.sys

exfat.sys

fastfat.sys

filecrypt.sys

fileinfo.sys

filetrace.sys

fltMgr.sys

fsdepends.sys

fs_rec.sys

hidbatt.sys

http.sys

hvservice.sys

hvsocket.sys

iaStorAV.sys

ibbus.sys

ipfltdrv.sys

ks.sys

lltdio.sys

luafv.sys

mlx4_bus.sys

mmcss.sys

mountmgr.sys

mpsdrv.sys

mrxsmb.sys

mrxsmb10.sys

mrxsmb20.sys

msfs.sys

msgpioclx.sys

mskssrv.sys

mup.sys

ndfltr.sys

ndis.sys

netbios.sys

netbt.sys

netio.sys

npfs.sys

nsiproxy.sys

ntfs.sys

pacer.sys

pcw.sys

pdc.sys

PEAuth.sys

portcls.sys

ql2300i.sys

ql40xx2i.sys

qwavedrv.sys

rdbss.sys

rdpdr.sys

refs.sys

refsv1.sys

rmcast.sys

rspndr.sys

sacdrv.sys

scsiport.sys

sdbus.sys

sdport.sys

spaceport.sys

srv.sys

srv2.sys

srvnet.sys

storport.sys

storqosflt.sys

stream.sys

SYMEVENT64x86.SYS

tbs.sys

tcpip.sys

tdi.sys

tdx.sys

terminpt.sys

tm.sys

tpm.sys

TsUsbFlt.sys

TsUsbGD.sys

tsusbhub.sys

udfs.sys

UevAgentDriver.sys

USBHUB3.SYS

USBXHCI.SYS

VerifierExt.sys

vhdmp.sys

videoprt.sys

vm3dmp-debug.sys

vm3dmp-stats.sys

vm3dmp.sys

vmbkmcl.sys

vmbkmclr.sys

vmbus.sys

vmci.sys

vmhgfs.sys

vmrawdsk.sys

vnetWFP.sys

volmgr.sys

volsnap.sys

vsepflt.sys

vsock.sys

watchdog.sys

wcifs.sys

wcnfs.sys

Wdf01000.sys

WdFilter.sys

WdNisDrv.sys

werkernel.sys

wimmount.sys

WindowsTrustedRT.sys

wof.sys

ws2ifsl.sys

WUDFRd.sys

xboxgip.sys

3、paged pool : the most consumer's tag is "Ntfc"，ntfs.sys is base on search by tag "Ntfc".

Is there any bugs related to the description above ?