Can I find out what exactly is "android system" traffic?
It's possible. I used ARM version of tcpdump command. You must copy that command by hand in /system/xbin/. In shell you ran:

tcpdump -i rmnet0 -w /sdcard2/tcpdump.pcap


After some time kill that tcpdump command and copy file tcpdump.pcap to PC. Then use Wireshark to load tcpdump.pcap file to investigate network traffic.