Difficult to say anything definitive from that estimated execution plan. Actual plans are much more useful since they contain run-time information, such as the distribution of rows between threads, actual number of rows flowing between each operator, and so on.

The estimated 15GB size referenced by Barry occurs in both plans before the aggregate. It just happens to be a hash aggregate in one plan, and a stream aggregate in the other.

Post actual execution plans, and we will be able to say more.