(forgive me if I'm preaching to the choir on this)
Bandwidth needed derives from:
resolution (number of pixels)
pixel depth (8-bit / 10 bit / bigger)
frame rate (10 is enough for most security setups)
compression algorithm and its quality settings
(Uncompressed standard-def video uses almost 250 MB/S, but decently compressed can be under 4MB/S.)
With compression, full frames are only sent every so often, the rest of the time it's difference information; so if little or nothing is changing between frames, the compressed bit rate can be quite low. The bit rate for a still image is almost nothing, on average. And different settings on each encoder will yield different bandwidths and image quality.
All that gets to- the lens itself won't increase the bit rate unless it's moving (zoom/aim/focus), which causes the picture to change, which causes difference info to be sent.
I'll also mention that 4k for security cameras is usually massive overkill. Maybe record it locally, but don't try to send it up to the cloud.