Sources of Internet Usage. Help me discovery why a spike in usage is occurring.

From what Xfinity has posted in the past, the cable lineup isn't supposed to count against the data cap, but streaming apps/music/other internet use does.  So youtube, peacock or netflix will burn data on the data cap. 

Data use by streaming apps varies quite a bit.  HD streams are rare these days.  UHD and 4K are pretty common now.  It also depends on the codec used to create the video.  Netflix uses H264 to deliver content for an example.  There also isn't one stream rate.  Videos you watch can be distributed in as many as 12 stream rates.  The one you are watching depends on network conditions.  It will try to find the highest resolution stream rate it can deliver without buffering, and shift rates on the fly.

A rough guide on bare minimum data burn In terms of GB/hour to meet the definition label:

                                   H264  H265

1280×720(HD)       1.35     .68
1920X1080(FHD)  2.7       1.35
3840×2160 (UHD) 11.25   5.4
4096×2160 (4K)     14.4     6.75

For other sources, there are many potential sources.  I've had an iPhone go insane downloading an update.  It was pulling over 12GB/hour retrying the download.  Stuck cloud backup/sync will do it too, as well as updates for software on PC's.  Windows using 'peer to peer updating' can do it too.  MS Office/Outlook and other mail can get stuck trying to redownload failed email or large email.  One-Source/One Note/any cloud based data storage or backup can do it.  Streaming devices (external boxes/sticks) can do it, and may not stop or timeout streaming or updating if you leave them powered on (firestick especially) -- turning the TV off does not stop this.  Cameras and IOT gear/smart devices can go insane.  It's also possible that devices are compromised on your network.

You can't see data usage per device with Xfinity gear which is why I don't use their stuff, just a monthly total on the Xfinity.com website.  You can see your data if you use other gear, and run all of your data including WiFi through it.  There isn't a data counter on MoCA/coax connected devices that I know of.  Also make sure there is a POE (Point of Entry) MoCA filter installed where the cable comes into your house.  They're about 1.5 inches long, about the same diameter as the coax.  It's a low pass filter that will isolate the coax network in your house from your neighbors.  Without it, your neighbors either intentionally, or unintentionally may be using your network.

For the 'scanners', they were probably looking for either vehicle key fobs or casing security systems for later theft.  Cars are easy to steal with the right equipment.  So far, WPA2 is still considered 'secure' for WiFi, and it takes an awful long time to break the encryption.  They'd be camped at your fence for a long time (month or longer with equipment if you are using a decent WiFi password).

The biggest problem is you can't see what is using data because Xfinity removed that ability, or do anything about it if it's a streaming box or MoCA device/set top box.  1.2TB is only 40GB/day average.  I can easily exceed that with what I do involving two off-site locations and a Roku or two.  Unlikely without severe issues, but a modest 300mbps speed tier is capable of pulling 3.240TB in a single day.

I'm using a firewall to monitor and throttle data per device, plus I don't trust the security of ANY cable router/gateway especially if it's configured via phone app (the least secure device you own).  You can't update it yourself.  Manufacturers don't update them when exploits are found.  Xfinity doesn't do any QA even if they did, plus the data monitoring on them doesn't work even if they pretend to count 'data used'.  They have limited ability to defend against hostile actors or network intrusion.

A fix could be paying for unlimited, however I would be still be concerned about what is running all that data if one or more of my devices are compromised, which is a far larger and potentially a financial issue. 

The solution is dumping Xfinity equipment, especially set top cable boxes.  Buy a 3rd party cheap cable modem.  Either make or buy a firewall and do your own mesh network WiFi.  Mesh WiFi is not expensive these days or use a couple of cheap access points.  Save $14/month.  It adds up.  There's budget.

For a firewall, check out opnsense (free), or netgate pfsense community edition (free).  Both will run on a retasked 64-bit processor box with two Ethernet ports in it.  Netgate sells a small firewall appliance box for around $200 if you don't want to build one.  Either one would give a hostile nation state actor with unlimited resources a run for their money with the default setup.  They have a lot of capability, most of which, you'll never need but it's there.  Then you control everything and can see everything on your network.       

+1 on the Opnsense / PFsense type suggestion.  These require a bit of a learning curve, but in my experience most people can get the basics down pretty quickly.  Anything like this will not only add a significant layer of protection to your network, but also provide granular details of everything passing in and out of your Xfinity connection.  You will be able to account for every byte transferred through your account to identify any problematic access issues.

If you are really concerned about this, Google Opnsense or PFsense and the interwebs are full of information.  And while I've never used the prebuilt Netgate products, I understand they are pretty much turnkey solutions.

On the xfinity app (I know but it's the only way :), click "connect" at the bottom. Then select your network. From there select "advanced settings". Then "XFinity Wifi Hotspot Network" and select "Do not participate".

Others are using your internet access for free wifi thus increasing your usage. 

That's what fixed it for me anyway.

As a precaution I would make sure they are disabled both on the my account option online AND in the app. I know that sounds like a no-brainer, but I've seen one disabled on one and enabled on the other. Maybe worth a try :)