Upload traces

[#1]

Last Friday (25/9) afternoon I noticed in Netmeter, and then my modem log, that my system had done and was still doing a large amount of unexpected and unexplained uploading.  I did what I could then - removed the machine-modem cable, ran MS Malware remover and also an AVG full scan - both negative - and checked after recabling that it had ceased.  I also got a later message from Google search on my Linux machine, that my then IP address had been blocked by them because of untoward traffic.
What I'm wondering now is, is there any way of divining from PN logs what kind of interference was at work, and what the motivation might have been?  I haven't totally ruled out an innocent piece of software going termporarily delirious, but ...  I'm afraid I can't atm find a note of my IP address for that day, but it was maintained for several hours, including well after the event.  I first noticed the uploads at 14:55.
Back to Zone Alarm perhaps now.  It at least has a bidirectional firewall.  I can't remember now the reason I switched from it.  Probbaly a bad interaction with some other software.

[#2]

Running Wireshark (from https://www.wireshark.org/) whilst the uploads are in progress will show you what is being transferred and the destination address. Note this can accumulate a lot of data very quickly - running for a few seconds is normally all that is needed.

[#3]

Change password on router?

[#4]

I guess that comment was may be seeking to suggest changing the wifi pass phrase to eliminate the possibility of a wifi hi-jack? 
In that frame of mind, do you have Ethernet over power plugs using their default security keys?  That can also be a source of having your internet connection hi-jacked. 

[#5]

Wireshark's been sitting waiting for a try out for some time. I've also refamilarised myself with ProcMon and TCPView, both from the Sysinternals stable, and configuring for that kind of monitoring. I only had the presence of mind to take screenshots of a quick Netstat and  a Task Manager process list, but neither of them showed up anything obvious.  I wish now I'd at least progressively killed off processes one by one.  Perhaps oddly, there's been no recurrence.
I don't use default passwords, and tediously have  to login to my modem each day to monitor usage.  The power plug hypothesis was beguiling, given that I'm in a multi-flat house, but a non-starter: the Devolo units I use are each individually connected using a randomly generated encrypted key.  Besides, the outflow showed up in Netmeter running on my Windows PC, which implies that that machine was the origin.