Hi
@dray, your correct I believe in that the hg612 is not sending data directly itself.
The router is showing the wan port (or lan1 on hg612) Mac and not that of the external to dslam. So is showing traffic at router level, not modem.
My thought was to fully separate out the router to modem and compare the results, which should show within 5 mins or so, if comparing current (live) stats ie router showing say 5 mb out and hg612 showing say 1 mb.
If both match, then there is something sending out data, which as it does not happen when no devices connected to router, then it has to be something on the computers/devices which connect to router (not trying to teach you to suck eggs here sorry), which is why my thoughts turned to iCloud or remote back ups, time machine etc...
In this instance, I would connect each computer/device every 10 mins and watch the current graph, to see when it starts to happen, which would narrow the search
I hope that helps and sorry if I'm wrong
Many thanks
John