Connected Apps.

Which of Your Salesforce Connected Apps Use Less Than They're Granted? Ask Your Own Logs

Static scanners tell you what a connected app was granted, not what it uses. Here is how to measure the over-grant per object from your own EventLogFile.