in or out of the machines? what are the queries? what frequency do they run?

out of the user machines. I am running queries of various apps running in user machine,USB and all of them are configured as differential logging.

What are the queries? What is the data? Data out of the machines should pretty much entirely be the results of your configured queries.