OK, by restarting the server you've eliminated the possibility of a large unlinked file held open by some process. One thing that remains is data hidden under an active mount point, the result, for example, of copying /home to a separate file system and then mounting that on /home without first removing the original content. Try this:
mount --bind / /tmp/tmproot
du -c --max-depth=2 /tmp/tmproot
If unwanted data shows up, you can delete it from /tmp/tmproot and free up that space in your root file system. Afterward, you can "umount /tmp/tmproot" and "rmdir /tmp/tmproot" and be back to normal (or, just reboot).