Please turn on logging of Headwind MDM (
https://qa.h-mdm.com/1573/how-to-turn-on-the-launcher-logs) and check for messages including "Downloading", probably this gives you some info about what is downloading by Headwind MDM. If you don't see such messages, it is not Headwind MDM who is using the traffic.
Unfortunately dumps of encrypted traffic are not informative and it is impossible to get any info from them.
UPDATE: Your logs contain a lot of records: Sending MQTT Ping at:1743176008279 It looks like, for some reason, MQTT ping was being sent each 5 seconds (normally it should be sent each 5 minutes!). If, at the same time, verbose logging was turned on, each MQTT ping was followed by a HTTP logging request, which potentially may increase data consumption.
Rebooting the device should resolve the issue.
If the issue persists, switch Push notifications from MQTT to HTTP polling. Open the configuration details, and set "Push notifications" to "HTTP polling".
In general, HTTP polling works more stable than MQTT, however consumes a bit more data and give more load to the server due to persistent HTTP connections.