I've been digging ncdu recently, which is basically a du replacement: https://dev.yorhel.nl/ncdu
du -k --max-depth=2 * | sort -rn | head
Ymmv, but playing around with max-depth is usually enough to find the culprit for me.
ncdu='ncdu --color dark -q'
-q for quiet, slows updating the ncurses interface down for a quicker scan.
also; -1 for scan info pre ncurses display and -0 for no scan info.