Bytes protected is not listing capacity used by backups. Bytes protected = The sum of the amount of space required to restore the largest single backup on each client which currently has a backup on the Avamar system. Used capacity is the amount of space used by all backup data after compression and RAIN. I don't believe it includes checkpoints. See previously linked KB for more details.
As mentioned in the KB 4.7 TB in your case could be:
- RAIN redundancy
- Data due to Retention
Not specifically mentioned in the KB but my understanding is the following would also not be counted in bytes protected:
- retired clients
- Any data replicated to grid (Clients in the REPLICATE domain)