To capture a trace of the CPU usage. Install the WPT from Win10 SDK, open a cmd.exe as admin and run this command:
xperf -on latency -stackwalk profile -buffersize 2048 -MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d C:\highCPUUsage.etl
Now do the action that triggers the CPU usage of the system process. When you see the issue, wait 30s, open the lid, go to the cmd.exe and press a key to stop logging.
My guess is that during analyzing the ETL file with WPA it will show, that the CPU usage comes from ntoskrnl.exe!MiScrubMemoryWorker
and you'll see something like this:
Line #, DPC/ISR, Process, Stack Tag, Stack, Count, TimeStamp (s), % Weight
8, , , , | | |- ntoskrnl.exe!MiScrubMemoryWorker, 79667, , 12,45
9, , , , | | | ntoskrnl.exe!MiScrubNode, 79667, , 12,45
10, , , , | | | ntoskrnl.exe!MiScrubNodeLargePages, 79667, , 12,45
11, , , , | | | ntoskrnl.exe!MiScrubNodeLargePageList, 79667, , 12,45
12, , , , | | | |- ntoskrnl.exe!MiScrubPage, 79663, , 12,45
13, , , , | | | | |- ntoskrnl.exe!RtlScrubMemory, 79653, , 12,45
14, , , , | | | | | |- ntoskrnl.exe!RtlpGenericRandomPatternWorker, 38549, , 6,02
This is a function to test the memory for errors by filling / reading some patterns (ntoskrnl.exe!RtlpGenericRandomPatternWorker
).
This is by design and happens when the idle maintenance task kicks up when your device is idle.
To stop it, use Task Scheduler and disable the idle maintenance task.