Just to make the output of your audit tool understandable:
the reason why it made the /var suggestion while linking it to the issue in the /tmp /home dir, which can be easily filled by users, is simple: the problem a workstation/desktop has with its users in /tmp /home, is the same problem a server has with its daemons/services in /var.
So, the services & daemons of servers store their variable information (including logs, and so on) in /var. So, if a daemon has a flaw, or gets unintended input from the Internet or such, it may completely fill the /var dir (excessive production of logs can be sufficient to fill /var after some time, but there are also other possibilities to fill it). So, servers or other machines that run comparable processes, should separate /var for the same reasons why it makes sense for desktops/workstations to separate /home /tmp (the latter is often a tmpfs anyway).
If you use your system just as normal workstation/desktop, there is usually no need to separate /var, as the daemons you run are not likely to create such situations.
If you want to make some space free in /var, I would start with cleaning up the journalctl , deleting the journal entries that are older than a few days, e.g.,