HAve you tried an interface report with received traffic today (assuming daily vs real-time will better find your culprits) and include in the filter section the same line but in a complex statement of field value > (your threshold) AND interface caption contains "backup" or such.
group by location, then hostname to better
Of course if you have no way of determining the backup links then your report will show all your other links.
And you should consider filtering the top xx interfaces by traffic resource to give you the same results with no need to write a report