Well for now, the SAFEST bet temporarily would be to perhaps call in, and get the UNLIMITED addon. As its only $10-$15 (depending on your plan, etc), will at least hep cover until you solve where its comming from. (i THINK it goes till the end of your cycle if its added on now, so i THINK it will cover the overage? Not sure.)
THat when its OFF, there is no usage at all... makes me think that its NOT a MAC cloning issue.
All in all, might be still a good idea, to swap the modem anyways, JUST to be sure its not another modem issue.
Make sure, to do a good MALWARE scan, as well as the AV scan. Most AV, only does a mediocre job at malware scanning. Try something like MALWAREBYTES.
Double check, for all possible things which MIGHT be connected to the interenet... phones, smart TV, bluray players, etc.