Scanned by this remote scanner, nothing found, just an advertising scanner.
actually I used Duplicator "Create Package", it will scan the wordpress site briefly, the size is 280 mb and the MySQL is about 11 mb. (i.e. the increased usage for MySQL database is not the wordpress database but another datebase)
So I think the problem is outside the public.html directory.