If you haven't enabled hourly or daily Cost and Usage detail reports, do that now. These reports break down everything that generates a charge, by resource-id and the exact type of usage that generated the charge -- so traffic to the Internet, traffic using public IP addresses, etc., is all broken down by the specific instance, balancer, bucket, etc., that generated the traffic.
For a coarse view, check the instance metrics for
NetworkOut metrics for each instance, in CloudWatch. These are all traffic for the instances, including internal traffic not crossing availability zone boundaries.
Load Balancers also have coarse metrics for bytes processed.