The dump was 550GB large. So I guess the only explanation for this are the accumulated keys_zone sizes. There are no third-party modules. We only see the leaks for specific HTTP/2 traffic at every reload. Posted at Nginx Forum: https://forum.nginx.org/read.php?2,267669,267748#msg-267748