TCP/ip traffic

We have 2 sites about 1400km apart and linked via WAN. On Saturday afternoons our offices are empty (bandwith usage is minimal. Our logs have reported that b/width usage was everaging 100% during this period. What could be the cause? (faulty routers, ,loops,hacking, etc)