Devices Used:

OC200
Hardware Version: V1
Firmware Version: 1.2.2 Build 20200424 Rel.58128

EAP225-Outdoor
Hardware Version: V1.0
Firmware Version: 1.7.0 Build 20200113 Rel. 35383

Every since I updated both device's firmware to their latest available updates, I've got this weird issues where unauthenticated users gets high download/upload usage in a very short amount of time. Since they are unauthenticated, meaning, they connect to the wifi, displayed WiFi Portal Login (voucher type), they didn't login, they remain under User Type (unauthenticated), not under Guest Type (Authenticated).

Aren't unauthenticated users supposed to be limited to portal access only until logged in successfully? 

When I first encounter an unauthenticated user that consumes 70MB and around 50MB in less than 15 minutes, I thought that user was hacking my network, obtaining free internet without using a valid voucher code. I checked the users past logs and found out that there was no previous log of successfull authentication. So I banned the user from the network.

Today, I encounter another one. This time, a regular customer of mine. Consumes 40MB both upload and download in less than 30 minutes. How come these devices consume that much of bandwidth when they're just limited to portal page. My portal page is only about 100KB.

I'm just wondering why random devices are able to consume large bandwidth (upload/download) without passing Voucher Authentication.

I didn't encounter these issues before I upgraded to the latest versions of both devices, OC200 and EAP225-Outdoor.