12.1.5 - high bandwidth between SEPM and a GUP at a remote site

I was investigating reports of WAN performance issues at one of our remote sites and i am seeing a high amount of traffic between the GUP for the site and the SEPM at the corporate headquarters. 

In the past 24 hours there has been almost 16GB of downstream traffic from the SEPM to the GUP with several points in time where it was saturating the WAN link with traffic. 

Any ideas as to what's up with that?

I thought 12.1.5 was supposed to be using delta changes for defs which would overall reduce disk space and network bandwidth requirements.

Thank You.