Specifically I’d recommend running
du -kx / | sort -n | tail -49
or similar, on your server, as root. You need a tactic which looks at what’s actually going on, without assumptions.
While you’re at the command line, I’d suggest
df -mT
free
And even
docker system df
docker images
I’m concerned about what you’re saying about backups. There are two kinds of backups: the normal kind which includes attachments and the lightweight kind which excludes them. They should be different sizes. You will have some configured choice of automatic scheduled backups. It seems possible to me that the automatic backups are happening when there’s space, and that fills the space.
I recommend you have a good look at files before you delete them - what’s the date and timestamp, what’s the size. That will help to determine how they came into existence.
It worth noting that deleting an open file will cause it to become unlisted but it won’t be deleted until it’s closed. It’s even possible, therefore, that you’ll see a different picture after a server reboot.