One suspicion I have is this: Proxy and dynflow log file rotation
Here is a small patch, can you apply it, set file_rolling_size to 0, restart and report back please: https://github.com/theforeman/smart-proxy/pull/667
All components from Foreman and even Katello can be configured for syslog logging and we could easily get rid of this rotating madness completely if we were able to configure rsyslog/syslogng to deliver messages to the same filename. But thanks to Puppet, this requires huge amount of work and another two components to manage which @ekohl is not happy with. I wish there was an easy way to solve this, syslog/journald is much more powerful.
You can however tell the installer to configure syslog or even journald and then configure log file destinations yourself easily. All bits are here: https://github.com/lzap/foreman-elasticsearch (just skip the ES steps).