It is important to note that Microsoft Forefront Threat Management Gateway (TMG) does not log data in in a constant stream of packets. Only when a connection finishes, or a download completes does it write size values out into the log.
Say for example someone starts downloading a 4GB .iso file at 9am, but it doesn't finish until 12pm. At 12 pm you will see a spike in your bandwidth charts showing this 4GB download.
Another point to note is that TMG also logs internal to internal traffic. So if you have some very active internal chatters or intranet sites, this may inflate your bandwidth charts.
The Overview dashboard has a section showing the average size for both today (past 12 hours) and the past 15 minutes. In the 15 minute section, this refers to the average size for every 60 seconds. For the today section, this refers to the average size for every 30 minutes. These numbers indicate your 'typical' usage, so that you can compare with your actual usage throughout the day.