I meant like in general…

I do agree it’s worth investigating if it happens again. My best guess so far would be some kind of data written to a tmpfs. That’d explain it not being associated with a particular process, yet counting towards actual used RAM.

Why do you care so much about memory usage?

Unused RAM is wasted RAM.

You can use journalctl -b <index>, where 0 is the current boot session, -1 the previous boot session and so on.

You can see all sessions with journalctl --list-boots if you want to pick a specific one.

Spacebar looks promising IMO.