Do you see a flood of logs or spike of logs at that time also? GB is a LOT, it seems unlikely it'd happen without some logs associated...
You might also check the logs in the agent on that system and see if you can find something happening right around that time (spoplog.txt or SWLEMAgent.log in the agent install directory). Did the agent restart? Did it note that it was reading logs? Anything else?