Why are you using a 60 second keep-alive ping? The default is 23 minutes and if you are using the Particle SIM you should not have to change it. If you are using a 3rd-party SIM it could be necessary.
Each keep-alive uses 122 bytes of data but no data operations. That adds up to 5.2 MB per device per month, plus your other usage.
Are the devices that are using a lot of data also dropping their connection? Reconnecting also uses data but not data operations and the amount can be significant for devices that are unable to do a session resume and instead have to do a full handshake. The most common cause of that is poor connectivity such that during the resume, the process fails, so it needs to restart over with a full handshake, which can take 5K of data per reconnections. A session resume is only a couple hundred bytes.