Help: Our ingest costs exploded last month and I can't figure out why

Our Sumo bill jumped 35% last month, and our usage didn't increase proportionally. We're on the Flex plan.

I've checked the obvious:
* No new data sources were added.
* Our forwarder configs haven't changed.
* No major incidents that would spike logs.

The Cost Insights dashboard shows the increase is in "Ingested Data Volume," but the breakdown by source/host doesn't line up with our internal metrics.

Has anyone done a deep dive on this? Specifically:
* Known culprits for hidden ingest (metrics? tracing?).
* Are there retention or archiving settings that can backfire?
* What's the actual ROI on their "Log Reduce" feature for cost control?

—CR