Fake traffic not well identified and intermittent (CRS310)

Hi all,

I have a CRS310-1-5S-4S+ that acts as a core on a network with other peripheral switches connected to the CRS310 via optical fiber, the strange situation is this:

Of particular configurations we have two bondings composed of 2 interfaces each, in active/passive mode which work perfectly, and the switch is free to transmit all the VLANs to any port, having said that, the switch have a constant traffic of about 60 mbps incoming (video streams) from the sfp4 interface (uplink from the firewall) and outgoing from the sfp5 (video wall), while the other interfaces make non-constant traffic based on the navigation of the clients, the strange thing that happens is that randomly the outgoing traffic also on the other interfaces increases to 60mbps without meaning, it seems like a broadcast flood of something generated by the switch.

Below I put a screen shot of the anomalous situation, with the “normal” traffic highlighted in blue and the “fake” traffic in red:

What’s even stranger is that by doing a torch on any interface affected by this fake traffic the latter disappears, returning to normal values ​​as follows:

Fake traffic looks like this at a temporal level, lasts about 1 hour and then disappears for 15 minutes:

Apparently the network performance is not affected by this, but I would like to understand what generates it and eliminate it, if anyone has any ideas I thank you very much!