So there is autobackup that had been running.
There is also now adhoc task ... jobs that didn't complete (an autobackup would qualify) are rescheduled to run again at a later time. Have any adhoc task in the que?
Added to that ... recyclebin on removal of X - including mods in courses and courses and categories of courses.
In a troubled server, I turned off auto. I also set the recyclebin to display all the time in course admin menu so I could click on the link and remove 'stuck' deletes. And set recyclebin for the shortest duration in time to keep before moving to trashdir where by code whatever remains for 4 more days. :|
Yep, moodle very protective of deletes. :|
I also manually removed anything in moodledata/trashdir/
The troubled server had an all users forever course and in it an assignment for users to upload a 1 minute video intro. OP decided to remove that assignment ...which led to OP reported drive kept filling up and a run away (OP called it 'ghost') backup process. It was only by watching that area from command line that I was able to determine what was going on. That kept filling up with all the videos those users (some 7 thousand) had submitted. If one went to the course in GUI, at the bottom was the assignment pending deletion.
Had to let moodledata/trashdir/ fill up some .. then manually remove to keep space usage down ... watch some more ... and when it began to fill up again ... once again manually remove.
Finally, that process finished. Took almost a full day! :|
My 2 cents.
'SoS', Ken