Unusually high amount of traffic between a client and Endpoint server

Hello,

My network guys detected 50GB of traffic being transmitted between a host with the DLP endpoint client and the Endpoint server over port 8000.  There is no  policy incident that shows up.  Anyone have a suggestion for troubleshooting this, so I can identify why this happened?  Or does anyone have a suggestion why this could happen?

Thanks in advance,

Bob