It could be files and/or logs;
find / -type f -exec du -h {} + | sort -hr | head -20
It will find the largest 20 files on the system, printing them in order of highest and their human readable format; i.e.
112M /var/lib/snapd/snaps/lxd_24322.snap
105M /var/log/journal/350b612817a34e9390a66d76c804d469/system@c9f65515e6c54f578e67301dd8d798b5-0000000000005182-000611341a6a5e62.journal
97M /var/log/journal/350b612817a34e9390a66d76c804d469/system@c9f65515e6c54f578e67301dd8d798b5-0000000000020d26-0006115105db0e8d.journal
97M /usr/bin/dockerd
...
Might be helpful to someone in future.