Today labsdb1004 paged for FS full, after investigation turns out there were many binlogs created and the FS was extended.
@Volans looked into the binlogs and it looks like most activity came from s51370__isbntool.nrmentry. Judging by network activity starting 2016-11-10 around 3.30 UTC.