Is there a way to compile and analyze the Traffic on Mikrotik Routers and know what is constituting the heavy downloads by some users ? Ubiquiti have DPI which can show you whether it is youtube,torrent,facebook etc and you can take action.
You can see how much some downloads, what DNS request are used ++, but there are many but.
IF user has DoH or some other encrypted DNS request, you do not see what DNS are used.
You can not see inside HTTPS packets to see what is downloaded etc.
Look at link in my signature for see how I have implemented Splunk to analyse MikroTik logs,.