I understand that this is only a hunch on your part but my understanding of the term zombie is that it is a process or thread that has already terminated but might still be hanging onto some system resource(s). If it really has terminated, it’s unlikely to go chomping through memory, though may still be hanging on to what it had.,
If you want to follow-up on your hunch, why not create a cron job that will look for zombie processes (not so sure about threads). Something along the lines of
ps axo pid=,stat= | awk '$2~/^Z/ { print }'
will give you the PID of any zombie process. Just save it to a file for later analysis.
Similarly, if you think that memory is disappearing over time, the same cron job can run the free command or vmstat If things crash, you’ll be able to validate your hypothesis.