Most probably customer activity derived from the listing bug:
So as Alexey metioned in that thread, this bug probably caused some jobs like rclone sync would have uploaded more data than usual, in turn causing (most if not all of) the spike we saw.
rclone sync