A backup file that size shouldn't take that long, I agree. Obviously, something is going wrong!
mdl_backup_controllers table is a tracker ... moodle first builds a plan for the backup, then executes that plan - reporting numbers like 100 or 200 or 400 .... finished backups normally report 900 or 1000.
That table does have a column for epoch time stamps does it not? What does that column show?
That table should also remove related rows for a restore if successful. I have truncated that table in the past to start fresh again.
"is the backup transferred over the network to the webserver?"
Think you have a large site - web server or load balancer frontend, dedicated DB server and yet another dedicated machine for moodledata. That correct? IF so, then yes, there is some transfer of info over network - but I would think that more of a move in moodledata. Takes place according to and controlled by DB.
In moodledata/temp/backup/ the hash named directories ... should have date time stamps ... if those files are there, cron job didn't clean them up ... but that would make sense if the job didn't finish ... moodle job to do that didn't know the process was finished.
But do go in there an inspect what's there.
As far as restoring a course module back into a course, beyond me and I would think complicated.
Since that entire process is now in the background, think inspecting what is in those directories might give a clue. But they are not complete so may as well erase them.
Also think I'd change recyclebin settings and have the recyclebin link show all the time in the course menu. That should allow a module that was deleted a way to restore.
'SoS', Ken