Seems to me that you have a “NAS” (given by the interface comment) that is being accessed. Maybe you have a Torrent Client on the NAS? Maybe even a Plex server syncing to the cloud?
Do you have a decent set of filter rules? A blacklist?
In this post: http://forum.mikrotik.com/t/blacklist-filter-update-script/89817/1 I give a very nice set of firewall rules to help out.