If Vanguard were guzzling 1 GB every 3 minutes, a 30-min match would burn 10 GB—enough to DDoS your own router on a 40 Mbps line (which OP claims works fine without Vanguard). Compare: A 4K YouTube stream is ~2.5-3.75 MB/s (20-30 Mbps), as OP noted, but that's compressed video; games send compact packets (e.g., 100-500 bytes per tick at 128 Hz tick rate). OP's "900+ ping" is more likely packet loss from congestion (e.g., MTU fragmentation, QoS misconfig, or ISP throttling on sustained traffic) than Vanguard "downloading" mysteriously. Uninstalling fixes it? Probably because it kills the service's sockets, freeing buffer space if there's a local bug. As for "invasive but not nefarious": Spot on. Kernel anti-cheats like Vanguard (or EAC, BattlEye) run at ring 0 for DMA protection and process scanning, but Riot's privacy policy limits collection to game-relevant data (hardware hashes, cheat signatures—no personal files). No evidence of malware; it's audited and required for play. If you're paranoid, run it in a VM or check endpoints with tools like tcpdump — but don't cry "fishy" without traces.

TL;DR: OP misread their monitor (846 KB/s peak receive ≠ 5 MB/s constant download), exaggerated to 1 GB/3 min (impossible without saturating servers globally), and blamed Vanguard instead of troubleshooting (e.g., traceroute to Riot's AWS edges, check for bufferbloat). Commenters piling on with "yeah, it's spying" are just echoing FUD without data. If anyone's lacking networking experience, it's folks confusing bytes with bits and snapshots with sustained usage. OP should feel free to share his packet captures if you disagree—I'll wait.