Daniel,
It could be a baunch of stuff:
- broadcasts
- connected shares
- idle TCP sessions exchanging keepalives.
- background updates
You can check on the client itself via netstat command or on ASA using
show conn det address ASSIGNED_IP_ADD_RESS_OF_CLIENT
M.