If the previous suggestion doesn't shed any light...
The graph you have provided, seems to indicate "in bps" on the switch port (which attaches to the example AP). Correct?
If that's the case, the traffic level shown is sourced from the AP, not the controller necessarily. Of course, it could be reply traffic of some sort responding to a controller request (unlikely). Much more likely, it's some real ingress traffic from a device/user coming up the GRE tunnel.
What does the output bps graph look like for the same port (which will be controller to AP traffic)? That would be good to see.
Also, does the monitoring platform you're using allow you to tell what type of traffic is represented (via sflow/netflow or similar)? That might greatly help narrow things down. If not, you could try a wireshark capture of a mirrored AP-to-switch port physically near to you? Is that practical?