Answered already below. It’s not local files. I assume this is accessed over SMB from Windows:
Any idea how these work on an SMB share? Windows and Linux (is that what Synology is?) differ.
Linux sample metadata from ext4 filesystem:
{"unix:uid-gid-perm":"1000-1000-436","unix:owner-name":"name","unix:group-name":"name","CoreAttributes":"Normal","CoreLastWritetime":"637603542177629573","CoreCreatetime":"637603542177629573"}
Windows sample metadata from NTFS:
{"win-ext:accessrules":"[]","CoreAttributes":"Archive","CoreLastWritetime":"636995086065080123","CoreCreatetime":"637280032989835983"}
Since all your files seem to attract attention at once, maybe you can pick a small file and give it its own backup going to a local folder without encryption. If it falls in the same pattern of long runs, analysis gets much easier. Just unzip the new dblock and look at what the backup did. You should see only metadata unless file content changed, in which case one of the files in the new dblock should contain the change.