How to Determine the Source of Billed CloudWatch Metrics?

Can you please provide more details about the usage? When you expand the line item in the bills, you will find more details about the usage.

You can also use Cost Explore with Group By option set to UsageType and get a better understanding of what Type of Cloudwatch usage caused the spike.

You will then have to work backwards based on the pricing details for the specific usage. Please update the question with the above details and I will try and provide further steps to help investigate. :)

Edit 1: These charges are incurred either when you enable detailed monitoring or pushing custom metrics. Reviewing your initial query, I believe this is caused due to the detailed monitoring. EC2 instances push various metrics based on instance type. As a result, all these metrics are included in this charge when detailed monitoring is enabled. You can find the following in the pricing page:

"Typically, EC2 Detailed Monitoring is charged at $2.10 per instance per month (assumes 7 metrics per instance) and goes down to $0.14 per instance at the lowest priced tier. As with all custom metrics, EC2 Detailed Monitoring is prorated by the hour and metered only when the instance sends metrics to CloudWatch."

If you have disabled detailed monitoring, the charges should have stopped. You can confirm this by reviewing the Cost explorer daily view for the specific usage type. If you continue to incur charges, please reach out to the AWS Billing team and they will help you with it.

Regards, Harshavardhan