Mystery 4Gb uploads - itunes and apple tv?

This is driving me mad. I recently switched from un unlimited broadband package (slow ADSL) to a metered (fast 4G+) mobile broadband for home usage. When the package is unlimited you don't look for mystery uploads but when you only have 80Gb of bandwidth per month (and overage charges are $10 per 1Gb) you start sweating any uninitiated activity.

Over a 12 day period I have have multiple 4Gb mystery uploads. My attention was brought to this issue when I received a monthly invoice for $1100 from my ISP (Telstra). I then set about monitoring traffic through the router (the attached is from there) plus taking all phones off wi-fi. As of last night, I had chromecast, the mac and apple tv on the wi-fi. Over the last 48 hours, SOMETHING has uploaded 12Gb SOMEWHERE. I have disabled all cloud services, backups etc. The mac reports 16Gb of upload/download activity in total for the period. The router reports 24Gb of uploads alone for the same period.

Now 4Gb is a pretty consistent data upload. And it also approx the size of a itunes movie file. Could this be something to do with itunes/apple tv?

For reference:

nmap reports that port 49158 is open

littlesnitch reports negligible data usage by itunes

bandwidth+ reports 16Gb of data usage by the mac in total