SEPM box is generating a lot of traffic

I have about 30 sites all througout my domain. Each and every site has a GUP including the site where the SEPM is sitting. I have only allowed updates to run from Midnight to 6AM.

There are still bandiwdth issues with my SEPM, it will randonly spike access between itself and the designated GUP's. I have no idea why it does this, but it will do it during working hours and it will make things slow on the network and for the office it is "talking" with.

I would like to ask if anyone else has seen this type of issue and what to do to rectify it. It's not always the same GUP either. It can be a random site, but the top talker is AWAYS my SEPM.