Before you do anything else, go up and DELETE YOUR SAN that you just posted.
I know you don't know this, but NEVER post your SAN.
Hopefully you'll see this and do so before someone directly replies to that particular comment. Once that happens you can no longer edit the post and will have to wait until tomorrow for a rep to edit the SAN out of the post.
Without a PC, Glasswire isn't going to help, but that's okay. Without it happening often (and that's a good thing), the isolation test might not be of much help, but at least for that time it showed there was no data leakage. As of right now, and only going by that one test, plus experience, it's pointing toward one or both of your devices, but I don't have either of them so I can't be of much help to you with regard to just what is going on with them, which one is doing it (or both), and what on them is may be using the data.
There's no need to post a photo about the Exede plan. Different plans for different areas. I believe you. I just couldn't find the same plan you mentioned with plugging zips from different areas of the country into their plan selector.
I hope someone with those two devices can help you figure out what used the data.