I think your "number of bytes" metric is the wrong one. Consider two accesses. One reads 10MB from a file. The other reads every 512th byte of the file for the first 10MB. The "number of bytes" will be 512 times higher for the first access compared to the second. Yet they will both put precisely the same load on the I/O subsystem.
If you can accept "number of operations", which is just about as good or as bad as "number of bytes", then you have something you can actually measure. The `inotifywatch` program does this, and it's likely part of your distribution's `inotify-tools` package.
It will immediately tell you which files comprise the bulk of the accesses, and it will likely allow you to solve your actual problem.