I figured it out.
Apparently some Oracle dbf files were created under a new directory that was one level below a mount point:
ie

/u01/arc/server1
/u01/arc/server2
where server1 is it's own mounted filesystem so they created a directory called server2 but it's not mounted so it created it under /.
This slowly filled up / as data was written to the db.
My du -ak * | sort -nr command eventually led to the discovery, I just needed to sift through all of the output to find it.
Thanks to all who assisted.