Disk space getting used up but clears on reboot

Question

I have a server running ubuntu 20.04

If I run df the first line is:

/dev/root       35511052  3512708  31981960  10% /

run 2 seconds later i get

/dev/root       35511052  3512900  31981768  10% /

the problem is after a few weeks the hard drive is full. If I reboot the system it goes back to about 10% full. Any ideas what could be eating up my space or how to find it?

I should also mention I have several drives mounted to the system so commands like sudo du -a / | sort -n -r | head -n 20 return the large files on the other drives not the root partition which nothing should be writing to.

Update 1: another question suggested to do the following things:

sudo du -hsc /tmp

this returned 56kb and when cleared went down to 4kb and stayed there

sudo du -hca --time / | grep -E "^[0-9\.]*[G]"

this returned

1.7G    2021-01-04 20:23        /snap
1.6G    2021-01-08 06:19        /usr

both times are several hours/days old. However I will keep monitoring maybe an extra file will show up when the hard drive gets more full.

Another question I found suggested maybe a mount was not actually mounted but I have double checked and mysql, and program working directories are all mounted correctly.

Update 2: ran same tests again from update 1: sudo du -hsc /tmp returns 4K

sudo du -hca --time / | grep -E "^[0-9\.]*[G]"

1.7G    2021-01-04 20:23        /snap
1.6G    2021-01-08 06:19        /usr

Interestingly the / folder in both cases which is made up of multiple drives returns 105GB in both cases but df returns the 3GB more then it did yesterday for my root partition.

Update 3: Found a suggestion of using sudo ncdu -rx /

Interestingly df returns 6.0GiB but sudo ncdu -rx / returns 3.2GiB

does this help at all? I think the problem is related to one app run by crontab is writing a lot to the console.

Update 4: Found the problem. There is indeed a 2.8GB temp file but it was deleted by the app but not closed so it still took up space. if I kill the pid the space is cleared. Any good way to automate killing a process and restarting it on a timer?

Update 5: Service is a crypto wallet run from crontab using it to get chain data. I did manage to slow the memory leak down considerably but could not stop it. Also wallet is from an old dead project and code is not buildable anymore or would look in to altering code.