UDP traffic to EC2

You can capture wireshark log on the module

You might also shut down legato to see if this is related to legato stuff.
Or you can start the application one by one to see which application is generating the traffic.