So what was it? My money would be on (in order): Wal, logs, unexpected indices growth.
Some queries that requires a large amount of memory to process started to use disk.
Once the autoscaling kicked in, even if we would have realized about it, wouldn't have helped as you are locked out of the system.
The auto-scaling event was triggered earlier than our alerts for low disk available.
What I don't know yet, is that we have been moving services for multiple days, and the service that required the work_mem parameter was in production in that AWS for 48 hours before started to use disk rather than memory to process the SQL Queries.