Endpoint Protection

I have deployed SEP 12.1.2015 to users macs, and am seeing some odd things. The upgrade was from 11.x to 12.1.x. It seems that there are two NAVX processes running anytime a schedule scan is kicked off. One is being run under root, the other under the user's domain account. The result is a lot of speed issues for users and scans that seem to go on forever. Macs are running OS X 10.8.5. After uninstalling SEP and reinstalling, it seems to be running fine. I'm wondering if there is a legacy file that is kicking off a second scan from components that were resident under 11.x. If so, is there a location that I can search to see if it exists, and if so, remove it from user's Macs? Having to uninstall SEP for all users and then reinstall SEP would be worst case scenario. Any help, information, or thoughts would be most apprecaited.

Checkout this FAQ:

http://www.symantec.com/docs/TECH134203

There is a brief section on scans about halfway down.

Thank you for your reply. That doc had a lot of good information on it, and the section on scanning does confirm that scans are done as root. However, I can't find anything regarding the specifics of my scenario. Is it expected behavior to see a navx process on both root and the user account? If not, how do I eliminate the navx process from running on the user account?