How can I identify this 1Mbps being generated by my UDR?

In my home network I have a UniFi Dream Router connected to an EdgeRouter X. The UDR is not being used as designed - I'm using it as a combo WiFi access point and 4 port switch. It also runs my UniFi Network application to manage my other UniFi APs. It complains that it has no internet access, but still does the job I need it to do.

I'm seeing fairly consistent 1Mbps traffic being generated by the UDR. I say it's generated by the UDR because when I look at the ethernet ports and connected WiFi devices I can't see it coming from anywhere - I can see it going out the port connected to the EdgeRouter X, and on the EdgeRouter I can see it coming in from the UDR but I can't see where it goes from there - it's into my main Cisco switch and mixed with all my other traffic.

I was hoping to be able to identify it by turning on Traffic Analysis on ERX, but I see nothing at all. I suspect because the ERX is not routing - it's configured as a switch? Similarly, when I ssh into the ERX and run tcpdump, I only see the broadcast and multicast traffic from the UDR - I can't see anything that might be this 1Mbps.

As I was typing this I thought maybe it's the UniFi Network application updating the browser page I have open to it all the time so I closed that and it made no difference.

Any suggestions what this traffic might be or suggestions for how to identify it?