High CPU usage in System tracing to AppVolumes service

[earl_hoffman]

I have a VDI infrastructure (connection servers:  2111, AppVol servers:  2206), where my main production desktop pool (Windows 10 23H2) instances will accept a log in, and after about 5-10 minutes, the CPU usage goes to 100%.  In Task Manager, the "SYSTEM" process is the one using up all the slack.  After about 15-20 minutes, CPU utilization drops back down to normal, but the user can't get much accomplished due to the sluggishness during that time.  If you stop the AppVolumes service, the SYSTEM process immediately drops back to using a negligible amount of resources.  We are running Symantec AV and Carbon Black, but neither of them are showing anything in their logs that they would be doing to cause this issue.  Has anyone else seen this problem? 

[NateNateNAte]

I've seen something similar with a setup using Tanium - when it runs checks on every file system or disk for changes.  Do you have any specific policies in place with Symantec or CB that doe scheduled disk checks on new volumes, or on startup?  Those apps typically make calls to 'System' to run things 'in the background'. It sounds like the old myth of multi-tasking a processor in Windows...the task instructions don't always work that way.