MikroTik

I have hotspot running on RB750GR3 and sometimes there is unusual network activity. I am connecting internet through PPPoE client on ether 1,
but sometimes I see RX of ether1 around 20-30 Mbps but in RX or tx of PPPoE, there's no network activity. Even though i disable pppoe , ther network activity is still there.. please hep.

I'd start by configuring tool sniffer to sniff all traffic on ether1 into a file or, probably better, to send it TZSP-encapsulated to a PC on the LAN and capture it on that PC using Wireshark or tcpdump. You'll need Wireshark to analyse it.