Since IOTOP is not available on TOS 5.x just turned on briefly echo 1 > /proc/sys/vm/block_dump
which though does not show the amount of data being written.
3:16:18+00:00 kernel: btrfs-transacti(1103): dirtied inode 1 (?) on sda2
3:16:18+00:00 kernel: btrfs-transacti(1103): dirtied inode 256 (?) on sda2
3:16:18+00:00 kernel: btrfs-transacti(1103): WRITE block 41000 on sda2 (128 sectors)
3:16:18+00:00 kernel: btrfs-transacti(1103): WRITE block 41000 on sda2 (128 sectors)
3:16:18+00:00 kernel: btrfs-transacti(1103): WRITE block 41000 on sda2 (128 sectors)
3:16:18+00:00 kernel: btrfs-transacti(1103): WRITE block 59328 on sda2 (704 sectors)
3:16:18+00:00 kernel: syslog-ng(8937): dirtied inode 339 (messages) on sda2
3:16:18+00:00 kernel: btrfs-transacti(1103): WRITE block 128 on sda2 (8 sectors)
3:16:18+00:00 kernel: btrfs-transacti(1103): WRITE block 131072 on sda2 (8 sectors)
3:16:29+00:00 kernel: kworker/u4:2(7431): WRITE block 38384 on sda2 (8 sectors)
3:16:29+00:00 kernel: kworker/u4:2(7431): WRITE block 38544 on sda2 (8 sectors)
3:16:42+00:00 kernel: syslog-ng(9067): dirtied inode 343 (wan.log) on sda2
3:16:49+00:00 kernel: nlbwmon(4206): dirtied inode 291 (20200601.db.gz) on sda2
3:16:49+00:00 kernel: kworker/u4:3(8995): WRITE block 38664 on sda2 (8 sectors)
3:16:49+00:00 kernel: kworker/u4:2(7431): WRITE block 38672 on sda2 (8 sectors)
3:16:49+00:00 kernel: kworker/u4:3(8995): WRITE block 478952 on sda2 (16 sectors)
3:16:49+00:00 kernel: syslog-ng(9067): dirtied inode 339 (messages) on sda2
3:16:59+00:00 kernel: btrfs-transacti(1103): dirtied inode 256 (?) on sda2
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 40872 on sda2 (128 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): dirtied inode 257 (?) on sda2
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 481696 on sda2 (128 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 40872 on sda2 (128 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 481696 on sda2 (128 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 40872 on sda2 (128 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 60032 on sda2 (320 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 60416 on sda2 (640 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 128 on sda2 (8 sectors)
3:16:59+00:00 kernel: btrfs-transacti(1103): WRITE block 131072 on sda2 (8 sectors)
3:17:14+00:00 kernel: kworker/u4:2(7431): WRITE block 36688 on sda2 (8 sectors)
3:17:19+00:00 kernel: kworker/u4:3(8995): WRITE block 478048 on sda2 (8 sectors)
3:17:19+00:00 kernel: kworker/u4:0(8994): WRITE block 61056 on sda2 (256 sectors)
3:17:19+00:00 kernel: kworker/u4:0(8994): dirtied inode 1 (?) on sda2
3:17:19+00:00 kernel: syslog-ng(9228): dirtied inode 339 (messages) on sda2
3:17:40+00:00 kernel: syslog-ng(9360): dirtied inode 343 (wan.log) on sda2
3:17:44+00:00 kernel: btrfs-transacti(1103): dirtied inode 256 (?) on sda2
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 41000 on sda2 (128 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): dirtied inode 257 (?) on sda2
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 41128 on sda2 (128 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 41000 on sda2 (128 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 41128 on sda2 (128 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 41000 on sda2 (128 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 61312 on sda2 (832 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 128 on sda2 (8 sectors)
3:17:44+00:00 kernel: btrfs-transacti(1103): WRITE block 131072 on sda2 (8 sectors)
3:17:49+00:00 kernel: nlbwmon(4206): dirtied inode 291 (20200601.db.gz) on sda2
3:17:49+00:00 kernel: kworker/u4:0(8994): WRITE block 38384 on sda2 (8 sectors)
3:17:49+00:00 kernel: kworker/u4:0(8994): WRITE block 38592 on sda2 (8 sectors)
3:17:50+00:00 kernel: kworker/u4:3(8995): WRITE block 478096 on sda2 (8 sectors)
3:17:50+00:00 kernel: kworker/u4:3(8995): WRITE block 478400 on sda2 (8 sectors)
3:17:50+00:00 kernel: syslog-ng(9360): dirtied inode 339 (messages) on sda2
On my node it seems mostly caused by various monitors / logs writing by purpose to the SSD (the OS is running from SSD entirely).
So not sure, most logs would go to /tmp which is mounted as ram disk but there might be some monitor stuff like collectd, suricata, pakon, nextcloud, lxc, sql and the likes that may not dump to the ram disk or SSD (if installed).