/var mounted on tmpfs keeps filling up, and I can't find how/what

TrueNAS Core 13.0-U6.8. I think this started happening when I exported a pool then re-imported it to replace a set of smaller SSD drives with larger WD Red drives. Every 7-10 days, the /var folder is full, and things like the SMB service stop working. A reboot fixes it. tmpfs is mounted on /var. It says the size is 11Gb. When it is getting full, like now it shows 5.1Gb, I try to check the /var partition for what could be filling it up but I am not seeing it. I just can’t find any large files or folders that could be causing this. Below are my current outputs of the folder sizes (du -sh) and list of files in the root of /var

root@freenas01[/var]# df -h /var
Filesystem Size Used Avail Capacity Mounted on
tmpfs 11G 5.1G 5.5G 48% /var

root@freenas01[/var]# pwd
/var
root@freenas01[/var]# du -sh *
  0B	account
  0B	agentx
  0B	at
  0B	audit
  0B	authpf
  0B	backups
  0B	cache
4.0K	crash
  0B	cron
 54M	db
  0B	empty
  0B	games
  0B	heimdal
4.0K	lib
  0B	log
 13K	log.20260213092216
512B	mail
4.0K	md_size
4.0K	msgs
 16K	netatalk
  0B	preserve
du: fts_read: No such file or directory
root@freenas01[/var]# ls -l
total 11
drwxr-x---   2 root    wheel      0 Feb  1 17:17 account
drwxr-xr-x   2 root    wheel      0 Feb  1 17:17 agentx
drwxr-xr-x   4 root    wheel    128 Feb  1 17:17 at
drwxr-x---   4 root    audit    128 Feb  1 17:17 audit
drwxrwx---   2 root    authpf     0 Feb  1 17:17 authpf
drwxr-x---   2 root    wheel      0 Feb  1 17:17 backups
drwxr-xr-x   4 root    wheel    128 Feb  1 17:17 cache
drwxr-x---   2 root    wheel     64 Feb  1 17:15 crash
drwxr-x---   3 root    wheel     64 Feb  1 17:17 cron
drwxr-xr-x  17 root    wheel   1600 Feb 13 09:22 db
dr-xr-xr-x   2 root    wheel      0 Feb  1 17:17 empty
drwxrwxr-x   2 root    games      0 Feb  1 17:17 games
drwx------   2 root    wheel      0 Feb  1 17:17 heimdal
drwxr-xr-x   4 root    wheel    128 Feb  1 17:17 lib
lrwxr-xr-x   1 root    wheel     58 Feb 13 09:22 log -> /var/db/system/syslog-1e9984bcf13340bcb68bc263ecb0a902/log
drwxr-xr-x   7 root    wheel    576 Feb 13 09:21 log.20260213092216
drwxrwxr-x   2 root    mail     576 Feb  1 17:15 mail
-rw-r--r--   1 root    wheel      1 Feb  1 17:15 md_size
drwxr-xr-x   2 daemon  wheel     64 Feb 13 09:22 msgs
drwxr-xr-x   3 root    wheel    256 Feb 13 09:22 netatalk
drwxr-xr-x   2 root    wheel      0 Feb  1 17:17 preserve
drwxr-xr-x  14 root    wheel   2752 Feb 13 09:22 run
drwxrwxr-x   2 root    daemon     0 Feb  1 17:17 rwho
drwxr-xr-x   7 root    wheel    320 Feb  1 17:17 spool
drwxrwxrwt   8 root    wheel   2496 Feb 18 16:04 tmp
drwxr-xr-x   3 59      59        64 Feb  1 17:17 unbound
drwxr-xr-x   2 root    wheel    128 Feb  1 17:15 yp