running the old du -hs * from / I noticed /var had a lot of storage being used.
(yes I dont have separate partitions on my smaller VMs)
Looking further I could see that it was pretty much being used in /var/log/journal:
# journalctl --disk-usage
Archived and active journals take up 3.9G in the file system.