We started getting a similar issue since a few days with one virtual (2 vCPU) Windows 2012 R2 server installed with SEP 14 MP2. SymHelp didn't show any significant issues. Shared Insight Cache is not used. Netstat.db* does not even exist.
SEP worked well with 12.1.6, 14 and 14 MP1 on that server. After upgrading it to MP2 on 29.6. ccSvcHst.exe started to consume CPU/RAM on 7.7. for the first time or at least this day my colleagues saw it the first time.
First I thought it may be due to scheduled scans not finishing during the night (>3TB file server) so I split the Job (https://www.symantec.com/connect/articles/symantec-endpoint-protection-modifying-xml-based-policies-increased-functionality) into smaller jobs and planned them for different days. This didn't help. ccSvcHst.exe still consumes a lot of CPU (20-90%, avg. at approx. 50-70%) and RAM (I saw a maximum at approx. 400M) without any scan being actually run.
Turned on debugging (Help->Troubleshooting...->Debug Logs) and didn't find anything "special" in those logs while the issue exists except regular communication with SEPM.
During the time the issue exists, accessing the files/folders on that server through CIFS/SMB is extremely slow. Displaying a folder with a few files/folders in it takes very long time and may time out eventually. Disk I/O is very low during that time.
In our case a server-restart is not needed, smc -stop followed by smc -start is sufficient to "resolve" the issue for at least some hours. Currently we're restarting SEP daily on that particular server as this issue existed every morning since about a week. For tonight I plan to add 2 more vCPUs to this VM to see if it helps to cure the symptoms for the users at least and most probably downgrade to MP1 in the weekend to see if that helps ...