Analyse differential backup to see why it is so big
Take snapshot of sys.dm_db_file_space_usage, the modified_extent_page_count column. This is exactly what is says. How many extents has been modified since last full backup, measured in pages.
This column was introduced in 2016. Prior to that you would crack the DIFF map pages. Just as explained and exemplified by Paul Randal here, and as suggested by @Mo64 in a comment.
Take such a snapshot every 5 minutes into a table, and see when it blows up. Possibly tis is enough for you to determine what is causing this. My guess is some batch job.
If that isn't enough, keep going so you have a reliable pattern (&quot;every Tuesday between 3 pm and 3:15 pm&quot;). You now can run an XE trace on your system at that time and catch the SQL submitted to your SQL Server.