Journaling just means that there was access on the disk. You need to enable Block Dump Reporting with:
echo 1 > /proc/sys/vm/block_dump
And then look in /var/log/syslog for what is accessing your drive. It will gives you lines like this:
Jan 15 21:48:29 openmediavault kernel: [136750.727828] Plex Media Serv(16049): dirtied inode 19005559 (CloudAccess.dat.tmp.XXKRFvj3) on sdc1
Which show exactly what accessed the disk. In this case it was Plex accessing the CloudAccess.dat.tmp... file on sdc1.
Or you can use the automated shell script I wrote which does this for you:
My Guide to Debugging Disk Spin-ups
Randomly disabling services might not get you where you want to go. For example with SMART set to standby and it won't wake disks to test them, but you still have a smart log in /var/log/smart.log which updates every 30 minutes with what smart is doing, even if it didn't wake up disks to test them. If your smart log is on the disk in question you'll still have smart waking it up every 30 minutes to update its logs.
Also, be aware that turning on block dump reporting will cause a lot of information to be written to the /var/log/syslog file. I have that directory mounted in memory (tmpfs) with the flash memory plugin. But if it's on a physical disk and the one you are trying to get to spin down, it will actually interfere with you getting the disk to spin down.