I assume that’s a graph of network activity attributable to bitcoin-qt.
My hypothesis for the sharp peaks would be that there is a low level of chatter where the node finds out whether peers have new data using small inventory messages. Occasionally a peer has new data and the peaks might represent the actual bulk transfer of that newly discovered data in larger data messages.
The newly discovered data could arise from newly created unconfirmed transactions or from newly mined blocks.
I suppose the only way to actually confirm this would be to correlate the network activity with bitcoin log entries.
I would use Wireshark or another network-sniffer to capture and decode the data being sent & received. I believe Wireshark has protocol decoders for Bitcoin traffic.
