Hello.
It makes no sense to use average during whole day (or a month), as you do the capacity management to avoid business impact due to link utilization; and average does not help you to catch is the end-users experience any performance issues.
Typically your capacity management algorithm/thresholds are dependent on traffic patterns. As theses are really different cases if you run SAP+VoIP vs. youtube+Outlook. If you have any business critical traffic, you need to deploy QoS (unless you are allowed to increase link bandwidth infinitely).
So, I would recommend to use 95-percentile of maximum values on 5-15 minutes interval (your algorithm/thresholds will be really sensitive to pooling interval, so choose it carefully). After to collect baseline (for a month or so) - go and ask users about their experience and try to correlate poor experience with traffic bursts. This would help you to define thresholds for link upgrade triggers.
PS: proactive capacity management includes link planning for new sites and their impact on existing links (in HQ and other spoke).
PS2: also I would recommend to separately track utilization during business hours (business traffic) and non-business (service or backup traffic).