Nice to know you got better results now! Just curious, what are the changes you did to the modem?
The data transmission shown on Thinger is just the size of the effective payload, so, it is normal that the operator size is greater taking into account the TCP/IP plus SSL stack. However, the ratio you show (94%-6%) seems quite unrealistic even with the stack overhead. I am not sure how a mobile operator computes the traffic, but it could be charging also the underlying radio protocols?. A good test could be to let the device connected for 12 hours without any sending (just the keep alives, which are 2 bytes up&down every minute).
Regarding the IOTMP protocol, it will improve a little bit the bandwidth, but taking into account that your payload is only 6% of the total traffic, it will not be noticeable. However, it allows configuring the keep alive timeout, so you can save some traffic there setting a higher value, i.e., 5 min. Hope we can pre-release an Arduino library before summer.