The most common source of those suggestions is phone contacts. Anyone using the Facebook (or Instagram) app is sending them a copy of their entire address book to be used for network mapping purposes.
How about Whatsapp? (especially since it apparently keeps all whatsapp contacts in "unknown" state if you deny the permission on android)
I don't know if this is still true given the permissions model on Android (don't know about iOS). I just checked IG and it only has access to storage. Contacts, SMS, microphone, etc are not enabled.