$variable label names: example

pass proto tcp from $client1 to $mail_servers port $mail_services \
     label "$srcaddr"
pass proto tcp from $client1 to any port $web_services label "$srcaddr"

Accumulate periodically using pfctl -vslz (the z reset counters), feed to database

Explore the idea: Use labels in authpf rules, collect stats to put $user_ip in tables according to traffic counter, move between altqs. Doable?