xpcproxy using all my bandwidth
In my case, it was nsurlsessiond (by sudo lsof | grep -i nsurl)

Fired up Charles with https MITM'ing, but didn't find anything talking to Apple (but it wasn't making any new connections to intercept).

It seemed to go away after a little while.

EDIT: After sleeping and waking it up with Charles running, xpcproxy showed it was downloading pictures from iCloud ([redacted].icloud-content.com).

(xpc services need some better monitoring tools and/or they're not well-known.)