Large bandwidth was continuously used to download files from SEPM to a specific SEP client.
The SEP client didn't update VD for more than 3 days. So it tried to do full VD download from SEPM. But there's no enough space on C drive of SEP client host. The VD cannot be completely downloaded and installed. So lots of definition files were downloaded from time to time. That cause large network bandwidth usage.
Empty enough space on C drive of SEP client to finish VD downloading and installation.