That’s /var/log in the guest, and it gets mounted to /var/discourse/shared/standalone/log/var-log in the host, so the Discourse nginx logs are part of the 3.4GiB shown for /var/discourse. Some other site is on the machine that’s generating so many logs.