Do any services other than EC2s consume ip addresses in AWS?
There are many AWS services which requires a network interface such as AWS load balancers, Lambda, NAT gateway, VPC endpoints etc. For each AWS load balancer, it may use up to 2 IPs and 1 IP for 1 lambda function.
I would recommend to check the network interface section under EC2 service which will show you all the IPs which are currently being used and attached to EC2, Lambda, load balancer or some other service.
NOTE: For each subnet, 5 IP addresses will be reserved by AWS. So, if you have a subnet with /28 subnet mask (16 available IP addresses ), in AWS, you will get only 11 IPs which can be used.