Not familiar with NFS, but shouldn't it have been possible to attribute the mystery traffic by port number by sniffing ?

This is a very nice use of eBPF and probably close to the imagined scenario the kernel developers proposed for this.

eBPF has a terrible name but it's absolutely wonderful tech. If you're running a database SaaS you can implement eBPF filters to do the accounting for billing based usage, regardless of which database you use!

To me that's irrefutable evidence that it's really well designed