Well, AppArmor is obviously a problem, as are the flushing of the journal and the mounting of your root filesystem. And they could all be related.
/etc/systemd/journald.conf and see how much space it is allowed to use. I believe it uses up to 20% of your partition by default, but you can tweak it to maintain a much smaller journal.
On my own system, I have
/var as a separate filesystem, and so the default size of my journal is a lot smaller than on yours.