As an instance of svchost.exe hosts multiple system services, here is how
to separate the services, each to his own instance of svchost.exe,
so as to find out which service consumes the CPU.
The procedure is as follows :
Use Task Manager to show all processes sorted by CPU descending
and mark the PID of the processes that consume the CPU
In a Command Prompt (cmd) enter the command
Tasklist /svc /fi "IMAGENAME eq svchost.exe"
The problematic instances of svchost.exe can now be located by their PID
and on the right you will find a list of the system services that they host
For each of the names in the list enter the following command in a
Command Prompt (cmd) that is Run as administrator:
sc config <name> type= own
(Note the space between the ‘=’ and ‘own’)
The system services that you separated will now each run in its own instance
of svchost.exe and can be seen in Task Manager in the Processes tab.
You may right-click on an instance and select "Go to Service(s)"
to go directly to the service, or use again the tasklist command.
For more information see the Microsoft article
Getting Started with SVCHOST.EXE Troubleshooting.