unexplained increase in data usage

You're on the right track with a straight cable modem, and using something else for WiFi instead of a gateway that won't show you anything.  One more piece of equipment.  You need a box with two network ports in it.  Put that between the Modem and your WiFi Router.  Put the Modem in bridge mode.  One interface on the box in the middle to the Modem, the other goes to the WiFi Router.  

In a bare config on the box in the middle, you could run a Linux distribution as a static router and run something like darkstat to collect individual device network statistics from everything on your network.  Shut the DHCP server off on your WiFi router and forward DHCP requests to the Linux box running a DHCP server on the internal port for networking.  There are plenty of tutorials out there for this setup.

The other way is to use the box in the middle as a firewall with a distribution like pfSense or OPNsense.  Networking, monitoring, a firewall and DHCP is already configured then with the default install.  Add on packages like BandwidthD and ntopng will show you everything happening on your network in real time with historic data, plus you get a real firewall.  Your WiFi router still passes DHCP requests to the box in the middle.  A lot of other stuff you can do with it too, and quite a bit of functionality you'll never need or care about.

Every one and zero goes through the firewall, or outside traffic that doesn't find an open port or connection established by a natd client is blocked on the WAN side.  Then you'll know what you are using for data.

Xfinity data totals can be delayed by 24 hours -- so they say.  It's now 12/7/2022 and when I look at the data use page on my account, I can see they under reported by 300GB last month from what I know I used (and can prove I used), and it's currently showing I used 0GB for the month of December so far.  So I guess I don't know what Xfinity reports.  Currently, it isn't my data use.

Unfortunately, I don't have a Linux box with 2 ethernet ports.

I do have a spare computer with an ethernet jack and a wifi card.  Can I make that the wifi router with the firewall software?

Meh.  You can use any 64-bit box.  Even a laptop.  Although the USB stack [Edited: Language] for FreeBSD, and they don't recommend it, you can actually use a USB dongle for a 2nd interface.  Make that one be the internal network.

You are going to want to disable hardware segmentation and checksum offloading, and hardware large receive offload.  It's in system->advanced-Networking on pfSense.  Then it will work. 

There's a hardware limit to throughput then.  You'll only be able to slam what the USB device allows, so USB 2.0 for instance will probably only get you 53Mbyte/s throughput -- and that's dependent on other things on the bus, but for data logging it, it's fine for a test.  An Intel i3 is plenty fast.  You can get by with a Pentium if it's 64 bit.  Hard drive doesn't matter.  We're talking less than 40G for full blown logging.

All software is free and opensource.

Never tried a WiFi interface, but I suppose it could possibly work.  USB Ethernet dongle would be easier and they're cheap.  WiFi on BSD kind of works, but there isn't a linux firmware type package.  You'd have to add the driver if one exists for your wireless card. (pkg install driver-file).  If you are lucky and know exactly what the chipset is, it's probably in the pkg repositories.  

It's pretty much just a stripped down BSD install, with a web interface.  You'll want the vga distribution, or enable sshd so you can log in and use a command line for pkg search / pkg install if you are going to mod it and add things manually.

Also, the new distributions all require a 64-bit processor.  Opnsense does have an i386 version posted still if you have an older processor.  It's not too supported, but it would work for a test just fine.  The firewall will still be OK and logging will work.

Docs/install guide:  https://docs.opnsense.org/

20.1 was the last i386 release: https://mirror2.sandyriver.net/pub/opnsense/releases/20.1/

I wonder if I could run darkstat off a computer connected to one of the wifi router ethernet jacks.  I guess it depends on whether that acts as a hub versus a switch.

It will pick up traffic since it's running in promiscuous mode.  Now if you'll get accurate traffic counts is another story.  That's why I suggest the two network interfaces.

Traffic MUST traverse both interfaces to get to the internet.  There's no other way.  The Ethernet driver itself at a low level on BOTH interfaces counts the traffic.  That's down in the mud on the TCP stack itself.  Those are real transactions.  Real bytes crossing.  Install vnstat in that case too. It's a cool ancient utility that prints a nice text display of your data use today, yesterday, current month, and last month.  Tries to guess how much you'll use at the end of the current month based on what it knows currently.

Rough count will work for now.  At least I could see if an inside devices is out of control and which one.  Later, I could build a pfsense server with two NICs and downgrade the wifi router to a simple access point.