Just to wrap up (and leave out there for review). Decided initially:

/var/lib/rancher > /var/log > / 
With / still being 500G~1T
Expecting the vast majority of data to be in /var/lib/rancher

Depending on your PODS/Infra you going to run - . /var/lib/rancher is a LVM drive and 70Gi in size. The OS is also 71Gi in size. The /var/lib/rancher has pretty much stayed stable around 75-85% in use