Do we know what sort of traffic we're talking about? Without knowing your environment it's difficult to say if this amount is abnormal, but just as an idea - are the clients using the AH as a repository? Maybe it's update traffic that we're seeing rather than general agent-server comms...
It's mostly HTTP (80) traffic, but there is about 35Mb of HTTPS (443). I changed the settings for the agent handler assignment rules yesterday from use all agent handlers to use custom list and made sure that the master repository was the first one on the list and the DMZ AH was second so the internal clients would use the DMZ agent handler only as a failover. I can see that it has reduced the traffic from 20 GB to 4.8 GB
That sounds like it then