Happy to hear that your onboarding part worked fine!

I would first make sure that the security intelligence updates is done via server rather than each machine downloading and extracting it. Also, hope you have ran a scan in the gold image before sealing it for cloning. 

Attaching our scan GPO settings if that helps in some way. We also have a bunch of scan exclusions configured.

We also hit an issue with 100% CPU when the user logs into the VMs and Advanced Threat Protection was causing it. We had a few discussions with Microsoft, but their support was poor and finally we ended up doubling the CPU (we were planning it for some time, so we were prepared). 

Good luck!