Got the exact same issue. Seems that Security services is gobbling insane about of data. I've captured the data being sent over the cell network (everything is secured using TLS 1.2 or 1.3) but end up on the 17.0.0.0/8 subnet. So it's data sent back and forth with Apple owned Services, and cannot be controlled by the user (or it's background tasks that is doing this).
Because of the secure nature of the network traffic, it's hard to guesswork what it being used and the logs don't seem to give any insights. However, one thing is for sure, it's something tied to the AppleID. One thing worth mentioning, this network traffic is also happening on Wi-Fi but since most Wi-Fi access are unlimited or with high caps, it's not noticeable. But turning off data and only using Wi-Fi showed the same odd traffic pattern. The fact it's happening on cell network is just more observable.
I've logged out of my AppleID on my device, restarted it (shutdown and cold boot) and there is no further traffic (or very little)
Opened up a case and entered a bug report on the dev website, but so far, very little seems to be known about this right now. I'm somehow happy to see I'm not insane and not the only one having issues like this, and moreover happening on various carriers (even more intriguing)
Would be nice to see if those affected are using family sharing feature or not.
