I did find something now in one of the crons:
--------------------------
Adhoc task failed:
core_course\task\course_delete_modules,Coding error detected, it must be fixed
by a programmer: The course module 31804 could not be deleted. #0
/home/learn/public_html/backup/util/factories/backup_factory.class.php(65):
file_logger->__construct(30, true, true, '/home/learn/moo...')
#1
/home/learn/public_html/backup/controller/backup_controller.class.php(109):
backup_factory::get_logger_chain(false, 1, '3e35cb9eb8bf80b...')
#2
/home/learn/public_html/admin/tool/recyclebin/classes/course_bin.php(123):
backup_controller->__construct('activity', '31804', 'moodle2', false, 10,
'2')
#3
/home/learn/public_html/admin/tool/recyclebin/lib.php(151):
tool_recyclebin\course_bin->store_item(Object(stdClass))
#4 /home/learn/public_html/course/lib.php(1185):
tool_recyclebin_pre_course_module_delete(Object(stdClass))
#5
/home/learn/public_html/course/classes/task/course_delete_modules.php(66):
course_delete_module('31804')
#6 /home/learn/public_html/lib/cronlib.php(181):
core_course\task\course_delete_modules->execute()
#7 /home/learn/public_html/lib/cronlib.php(74):
cron_run_inner_adhoc_task(Object(core_course\task\course_delete_modules))
#8 /home/learn/public_html/admin/cli/cron.php(61):
cron_run()
#9 {main}
------------------------------
Any idea what's going on here? and why it generates 300 GB of temporary data?