The com.android.vending application is Google Play which would account for any Managed Play app downloads. You could likely rule out the App Catalog rule contributing to that 60% since they would be the driving force behind the 20%. 

I think we'd have to understand more about the Profiles and configurations you're assigning to the devices in order to be able to determine why 60% of the network traffic is caused by the Agent.

Thanks for your answer Matt!

I will try to detail the profiles and configurations...

There are 5 data collection rules (location with 5 minutes schedule, others with 30-60 minutes).

There are 5 file sync rules which only transfer files when they are changed.

There are 2 different application catalog rule with 9 apps in total (like Excel, Word, Adobe, etc. and SotiSurf).

We have one profile with 2 inhouse application, 2 package in one profile.

There is a profile to configure SotiSurf and browser restrictions, and an other profile to configure everything else like feature control, application run control, antivirus, out of contact, authentication.

The managed Google Play is set to always update. Chrome and Searchbox are blacklisted. Out of contact is set to reconnect after 2 days. If it matters I can detail the feature controls but I don't know they are relevant.

Check the device log in your web console for entries related to file-sync rules.  How frequent are file-sync check made and how many files have actually been synced?  Have you checked the size of the file synchronized?  For each of the  5 file sync rules, is a single file or a whole set of files (i.e. with wild-cards) specified to be synchronized? 

Also, if the size of the file to be synced is extremely big, and the quality of the communication channel is not good or stable enough, then there may be large number of retries that together contribute to excessive data traffic.   

The file sync rules syncronising one folder each. One of them with 70 files, ~125 MB. The other 4 rules syncronising other 80 files, ~70 MB together.

Could the problem be that the "Sync Files When Device Connects" option is checked? Is it possible that doesn't matter the files have been skipped? Here is a screenshot about the rule:

From your screenshot, you seem to have set the file-sync schedule to "every 2 minutes".  Is there a real need to sync so frequently for EACH AND EVERY of the 150 files?

Not only will there be impact on the data traffic, but possibly also the battery life of your devices and loading of your MC server, as the device need to hash all the 150 files and communicate with the server for comparing with corresponding files on MC server directory every 2 minutes.

To confirm if your mentioned  file-sync rules/settings are the  main cause of your problem, do a quick 24-hour test to measure the bandwidth change if a test device uses another set of file-sync rules of exactly the same settings except file-sync schedule (to say "every 10 minutes").  If there is significant reduction of data traffic within the 1-day test period, then you probably need to consider repartition your 150 files such tjat their associated file-sync rule can be synced at ACCEPTABLY lower rate.  For esample, some sync'ed every 2 minutes, some every 10 minutes, and some every 1 hour, etc. based on the likelihood of change, statistics of average-time between changes,  urgency of update, etc.

It is often OK, and even recommended, to have the "Sync Files When Device Connects" option checked, unless your device connection is known to be VERY unstable (i.e. device switching between on-line and off-line states every few minutes)  MOST of the time. 

Thank you Raymond for your advice!

If you look closer, the file sync rule is scheduled to run only once per day. But you are right, with the "Sync Files When Device Connects" option it can run every 2 minutes.

So I've removed this "sync when connects" option and changed the schedule to every 4 hours.

Based on the last 2 days data, it seems the Agent's traffic is dropped about the half of the previous amount.

Can we state that a File Sync rule can generate relatively large network traffic even there are no changed files, no need to download anything? Or can this be "Urovo-specific"?