The best solution to determine which applications are using network is to run tcpdump or wireshark (via easy debian). You can leave it capturing packets for few hours and then check what kind of traffic is this. Uninstall or block it then.