If it helps, with

aureport

I was able to pull out the top 10 files doing the

connect

syscall over ~30 minutes-ish (I don’t actually remember how long I left auditd running :/)