Use a comprehensive monitoring solution (eg MongoDB Cloud Manager
<https://cloud.mongodb.com/>) to capture a historical baseline of
activity. The size of queries is one possibility for increased network
traffic, but there are many other likely candidates such as increased
operations, queries returning large result sets (backup? initial sync?),
changes in cluster topology (perhaps chained replication if you have a
distributed deployment), etc.