the query shows that it was indeed the new IIS logs that were breaking the license.
sourcetype=iis | eval raw=_raw | convert ctime(_indextime) AS idxtime | stats count AS event_count dc(idxtime) as idxtimes_count, values(source), values(idxtime) by raw | where event_count > 1
is showing that every event is being indexed multiple times. I am still working with support to solve the problem, but I will post any resolution here in case it helps anyone else.
... View more