If you use a cron job to delete all sessions, you will delete all customer shopping carts and people will leave your site angry.
I suggest you look at your session files and see if they look suspicious.
Try checking where your visitors IP addresses are from here: https://www.iplocation.net/
If, for example, you find a bunch of Chinese IPs and your website is not Chinese, these are probably bots that are wasting your bandwidth. You should block their IP ranges in your Apache settings or in
(I believe you can even do country-based filtering in Apache but I think that it slows down response times. I haven't tried that.)
Magento 1.x (not sure about 2.x) also seems to have a bug where it creates a new session for every request when the client does not accept cookies. So bots like the Googlebot, Bingbot, SemrushBot, and others, all generate huge numbers of session files.
For my server, the only thing I needed to do was get rid of those bot session files. Until I have the time to find and fix the Magento bug, I have a shell script running by cron to remove all session files containing these strings: