I highly doubt that the S.o.S app is responsible for this increase in license usage because:
Although the app ships with two scripted inputs, these are not enabled by default.
Those scripted inputs (ps_sos.sh and lsof_sos.sh) write to the dedicated "sos" index.
The amount of data generated daily by those inputs is roughly between 50 and 75MB per instance where they are enabled.
The cause of your increase in indexing must be related to the upgrade to 5.0.3. Perhaps the Metrics view in S.o.S can help you figure out which sourcetype, source or host is responsible for this increase.
I will re-iterate my previous recommendation to use the Metrics view in S.o.S to attempt to determine what characterizes the data that increased in volume since the upgrade to 5.0.3. If you feel uncomfortable doing so and hold an Enterprise Support entitlement, you can open a support case to get some assistance.