@alyx @alyx @xue it was because logs were only rotated once a week and delayed compression was on. I basically had almost two whole weeks of uncompressed syslog.
I changed that to rotate every day and save 7 versions and removed the delay compression. I also added copytruncate just in case the delay compression was there for a reason.

I then ran logrotate and am mostly just waiting for gzip to chew through something like 90 GB of logs.