I found that some mobile data is consumed by unknown process. There's a huge difference between my ISP report and glasswire report, around 40mb for each 100mb used.
I know my phone is infected and someone spying on me but couldn't find how to get rid of that.
I wiped boot/recovery/data/cache and dalvik partitions before installing a custom ROM (dotOS) from a trusted computer. I managed to root the phone and install a firewall to check what's happening but got nothing worth it.
My assumption is that some process is still running somewhere, I have no idea how can I, at least, see what's going on. I do not have any background with Android development but I understand most of the concepts around it.
It's not a system application so please do not mention that.