Endpoint Protection

I have a software vendor that is claiming that SEP is causing slowness in their application.  For a test we disabled SEP and made sure all the services were stopped and tested.  They said that they still saw activity in the Windows Event Viewer logs after SEP was disabled.  Is this possible?

How did you disable it? If running 'smc -stop' from a cmd line then this article details everything that stops:

https://www.symantec.com/docs/TECH205841

If you did it via policy in the SEPM, there may be an item or two that was missed such as the application and device control component. That one is a little more 'hidden' so to speak.

We disabled by right clicking and choosing "Disable Symantec Endpoint Protection".  Then confirming that all Symantec services were stopped.  Is there a possibility by doing it this way some processes are still running?  If so, do you know what parts are still running?

It all depends on what is allowed to be disabled when you right-click and select Disable. If all lock icons in the various policies on SEPM are in an unlocked state for those specific components then right-clicking should work fine. If you open the SEP GUI after disabling it should tell you which ones are disabled.