Those aren’t the only containers. It could be containrd, lxc, etc.
One thing that might help track it down could be running sudo lsof | grep ‘/var/tmp’. If any of those files are currently opened it should list the process that hold the file handle.
“lsof” is “list open files”. Run without parameters it just lists everything.