What is the source of Aws Data Transfer [Global-DataTransfer-Regional-Bytes]

I found this answer that seems closely related to your question.

The key thing to note here is that DataTransfer-Regional-Bytes refers to inter-zone traffic, so it's very likely your OpenSearch instance is sending and/or receiving data to another AZ within the region.

You mentioned that your OpenSearch instance is accessed publicly. Is it located in a public subnet, or are you hosting in a private subnet and using a proxy in the public subnet to route requests to it? If OpenSearch is in a private subnet, make sure you have a NAT Gateway in the same AZ as your OpenSearch instance, so that any Internet-bound requests from OpenSearch will be routed to the local NAT Gateway, instead of to the NAT Gateway in another AZ.

As the article above states, the best way to pinpoint the source of traffic is to implement some form of network monitoring. You won't be able to run iftop on your OpenSearch instance, so I would instead enable VPC Flow Logs and see what traffic is being generated and try to pinpoint the traffic traveling across AZs.