The incoming traffic to our VPU appears odd. Over the coarse of the weekend (when we're closed), the inbound traffic rose to 455K and then dropped to nothing. This took about 14 hours. I can see it happen three times over the last day and a half. When we opened, the cycle completes in an hour or less. The size of the traffic, and the timing of the saw tooth looking patters, lead me to believe this has something to do with log files. Is there a way to post pictures? Viewing the graph would make it easier to understand.

You mean inbound IP traffic to the VPU's IP? Wireshark it.

Could it be MS automatic updates or anti-virus definition updates?

Post the pics somewhere and provide a link.