I kinda doubt that those 1.5GB would be the virus definitions or unpacking archives (unless you’re running on-demand scans every day).
But maybe(?) WebShield could generate some traffic, if you browse a lot…

Changing the TEMP folder would be worth a try (if you have a different drive, of course).