You could start at the server logfile of graylog and see if anything is happening there.
How many connections are there between graylog and mongo.
Has there been a configuration chance that could cause things running wild?
Is network okay between the cluster nodes?
Is mongod automatically updated?
Is java updated, i have seen things coming by with java updates causing strange things.
Is your ES cluster green?