I don't have experience with the part you're using but the following recipes are good practices when designing low-power devices.
Check for other leakages on your board (e.g. resistor dividers), put all the MCU pins that have pull-ups, pull-downs as inputs, try to stop the oscillator.
Another trick is to keep the MCU in reset and measure the current. While in reset, the I/O pins are normally inputs and the oscillators should not run. If the current is around what you've measured, then you need to check outside the MCU for leakages.
If the current drops around the expected figure, then you have to do more in the firmware.
Good luck!