What is maxing out my one WAN interface

I have a issue where one of our internet lines are being maxed out. But that traffic is not coming into the LAN, so firewall blocking it perhaps. Had this before a few years ago and it was caused by a file size limit, but we do not use that anymore.

If you look at the attached image, the WAN1 Incoming is maxed at 28.1Mbps, Internal and WAN2 graphs do match up as that is where users browsing traffic is coming in, WAN2, and out to LAN1. If the traffic was coming into the network over WAN1 then LAN would have shown close to 50Mbps, so firewall probably blocking it, but how do I see what is causing that?