There could be many reasons for tempdb space on a remote database to grow. Bad queries, direct queries into tempdb space, joins which query entire tables instead of selective records among others.
Given the queries that we perform from the database connector the most likely cause is an increase in memory use on the database which causes tempdb to be used once a memory threshold has been hit.
That suggestion lead to review of the connector logs showing we were reading the same records over and over again over time. In this case there were 10 database connections each polling the database every 5 seconds (default). The timebased query uses the following where at the end of the query.
where alerts.TIME_STAMP >= ? order by alerts.TIME_STAMP
This shows that we will always query events with the same time events until new events are created with a later timestamp.
Hence the reason we could read the same events over and over again. We would read them but not process them as they would be duplicate.
This is as designed and presents the best scenario to not lose events and duplicates are dropped before normalizing and forwarding to the destination.
default setting is.. agent[x].database[y].frequency=5