Step one, find your public IP, I like ipinfo.io but there are many other services that will show it. Then pop it into a tool like the one that's hosting TFA[1]

1: https://layer3intel.com/context

Unexpected traffic would be the biggest gross red flag. If it constrains itself to moving traffic when it's otherwise perform its desired function (if it's one of those "free TV" boxes and it only proxies when you're playing video) it might be hard to tease-out the unwanted traffic purely looking at bytes in/out.

Beyond that gross metric you're getting into capturing traffic and decoding it.

Check network traffic from smart devices would be a good start. If your TV does gigabytes of traffic in the night when you don’t use it, it most likely is acting as a residential proxy.