Many thanks for the responses, this has helped me a lot.
The Squid files - mainly the cache state was the primary issue. These remained post uninstall of the package. I think there might have been uninstall options to keep the cache etc ?
I checked the Suricate logs and I think that at some point, the log trimming was not working correctly - even though theoretically the GUI showed trimming enabled.
I re-applied the settings and the logs for Suricate appear to be trimming properly now.
Really appreciate the great help of forum members.