That's excellent! Not sure why, but I've seen processes ramp up usage when being actively scanned by an AV. My preference was to always ask that these specific processes be excluded from active scanning, but still be part of a scheduled scan. This way you're protected.
Thanks!