How to know what nsurlsessiond is downloading
That daemon (or system process) is invoked and handles network download requests from many apps and many other services on macOS. (And iOS and tvOS and watchOS)
I haven't found an easy way to get summary details or statistics from the session manager, but since it works on a queue to upload or download things, my guess is you have one or more job(s) timing out.
Here are some ways to pick apart the activity on your system:
sudo lsof | grep nsurl
ps -ef|grep nsurl
sudo fs_usage -w | grep nsurl

The first lists open files and sorts for matches of “nsurl”. The second lists all processes and sorts again. The third lists file system activity.
That will let you monitor things and see which of the several nsurl daemons is running when you measure 400 mb of transfer. You can also get a dump of the system activity with sysdiagnose nsurlsessiond
If you determine that it's really iCloud Documents, you'll likely need brctl log -w to watch that subsystem instead of monitoring the worker threads that do the lifting.