@Ross, disregard my previous question about the ingress bytes.
@B, Although I agree in general that it looks like a reporting anomaly, I don't see 150Mbps on any individual camera, rather it would appear that it is the VMS that is going that high, with the light blue camera going to 75Mbps. Since the VMS probably is Gigb it doesn't prove conclusively that the reporting is wrong.
@Ross, the transmitter/receiver data that you included, while certainly higher for the first camera, is in plausible range, based on the Axis bandwidth calculator, which shows 15GB-50GB depending on the parameters, for one day with that model camera. We would have to know more about the differences in the cameras settings/scenes to know for sure if something wrong there.
Going back to the first top 5 endpoints chart with the spikes:
I think that the fact that there is approximately ZERO bytes shown for the cameras and the VMS most of the time proves that something is wrong. To a network admin who may be used to nodes which burst traffic sporadically, it needs to be explained that these cameras, even if they are spiking, must also be streaming, otherwise there would be no live picture. Assuming that the cameras are always viewable, the onus should be on IT to explain the discrepancy.
If these spikes are always happening, can you just bring up the axis web interface during one of the incidents and watch the Mbit/sec counter realtime?