Running
perfmon /res
showed me that is was the system process (PID 4) that was doing the bulk of the writing. Searching for what that meant turned up all kinds of possibilities, but no way to tell concretely what file was being written to. I tried disabling automatic updates, security essentials, removing the virtual CD-ROM device, etc. No luck.
This morning I discovered by chance that within Resource Manager (opened using the command above) you can expand the 'Disk Activity' pane which is below the 'Processes with Disk Activity' pane and closed by default. This will allow you to see the file names being written and sort by Write I/O.
I don't know why this wasn't suggested in the dozens of pages/posts/KB articles I read, but there you go. Hopefully this will help someone out there.
