I have 15 computers all with the same problem. They all have an idle cpu usage of around 80%. This is straight after a login and persists for around 30 minutes before the problem temporarily resolves itself (until next restart.)
svchost.exe (LocalServiceNoNetwork) is using the CPU, and in resource manager MpsSVC is the service using the cpu. This service is related to the windows firewall.
Running windows in diagnostic start up cpu usage is normal. Disabling all non microsoft services still results in high CPU usage.
I've tried to repair using SFC. It says files are repaired, but issue persists on restart. Only one file appears in the logs as failed to repair, and shows up 4 times is:
2016-11-29 14:33:13, Info CSI 00000730 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.2.9200.16430, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
Have also tried using DISM with an up to date source with the same result.
I've also tried turning on the windows firewall logging, unfortunately the MMC snap-in crashes on these machines as well. The event log for windows firewall doesn't have anything that stands out.
Update
Thanks to magicandre1981 I have been able to identify the cause. After letting the firewalls calm down and finish enumerating their rules, I can access the windows firewall. There are an awful lot of browser choice rules that have been added. I can only assume its the sheer quantity of these, and new ones being created which is causing the slow down.