Constant CPU and Memory spikes from windows processes

Question

Constant CPU and Memory spikes from windows processes

Carles Chulia 5

My computer has constant lag spikes since a few days ago. At first I thought it was hardware related as it lags even at startup, but I could not find the problem with diagnostic tools and temps seemed fine (46ºC) with HWmonitor. After registering a spike with the tools open, I saw CPU went to 100% and memory to 80%. Even if I close every other app other than the monitoring tools it spikes to 60%.

Through process explorer and task manager, I saw most, if not all the load, comes from "System", "Antimalware Service Executable", "Service Host" and the like. I tried to locate the origin of each process and all seem to originate from legit locations and have the correct names.

What could be the problem? How would I go about fixing it? Attached are some recordings.

SystemInformation2026-09-0113-15-56-ezgif.com-video-to-gif-converter.gif

Administradordetareas2026-09-0113-23-09-ezgif.com-video-to-gif-converter.gif

0 comments

3 answers

Your answer

Answer 1

TaoLi 112K Independent Advisor

Thanks for the detailed update.

It sounds like the repair reinstall corrected part of the underlying system issue, and the remaining spikes were related to telemetry/system tasks.

If the PC continues to stay stable, I would leave it as-is for now. Please note that some telemetry-related tasks may be recreated or re-enabled after future Windows updates.

If the spikes return, please check which exact process or scheduled task becomes active at that time and share its name. That should help narrow down the remaining cause without disabling additional Windows components.

Carles Chulia 5 Reputation points

2026-09-16T10:32:14.7733333+00:00

Well, after a few days of truce, today it has come back with a vengeance.

While on a clean boot, the cpu and memory usage remains almost constant at a 60-70% cpu usage, not going down, and after a while running, the computer just freezes, fans go into overdrive and the screen goes black with fans returning to calm, but the pc is still on, not screen output. I tried Restorehealth or Defender's Offline scan again, but nothing new.

The main culprit this time is always "System" (ntoskrnl.exe; PID 4) with several different "Service host: Local System" or "Service host: Network service" (svhost.exe; PIDs: 4596, 2864, 1632, 1584, 2804, 1448, 5336... ), Desktop windows manager (PID: 1792), a bunch of instances from "Search>Microsoft Edge WebView2" (PIDs: 4740, 8412, 8360, 7508, 8404, 2928) and Antimalware Service Executable (PID: 4660). Other process such as Microsoft Phone Link, WidgetsPlatformRuntime, whesvc, and a few others come and go.

Answer 2

TaoLi 112K Independent Advisor

Since several Windows processes are spiking at the same time, I suggest first testing with a clean boot to rule out third-party services or startup programs:

https://support.microsoft.com/en-us/windows/experience/startup-boot/how-to-perform-a-clean-boot-in-windows

If the issue remains, open Command Prompt as administrator and run:

DISM.exe /Online /Cleanup-image /Restorehealth

sfc /scannow

https://support.microsoft.com/en-us/windows/experience/backup-recovery/using-system-file-checker-in-windows

If it still happens, you can use Settings > System > Recovery > Fix problems using Windows Update > Reinstall now. This reinstalls Windows while keeping your files, apps, and settings.

https://support.microsoft.com/en-us/windows/experience/backup-recovery/backup-restore-and-recovery-in-windows

Carles Chulia 5 Reputation points

2026-09-03T09:19:51.7566667+00:00

As a followup, clean boot showed spikes even with all startup programs shut down and deactivated with autoruns tool.

I tried DISM.exe /Online /Cleanup-image /Scanhealth and it show errors to be fixed. I run "/Restorehealth" and it said they where fixed, with "sfc /scannow" not finding anything, but upon running "/Scanhealth" again, more errors showed, so after a couple more tries with no success, I went with "Reinstall now".

It did "something" as memory in task manager was no longer showing crazy numbers, and cpu usage spiked a little lower (60-70%, with only a few 100s), but didn't solve the problem entirely. It did show that Microsoft Telemetry and "System" where still the main consumers and shutting down every process and programmed task related to telemetry seems to have done the trick, since I've been working a few hours with no spikes.

Hopefully it remains like this. Thanks.

Answer 3

Start by identifying which of those Windows processes is actually driving the spikes, because System, Service Host, and Antimalware Service Executable are umbrella processes and the fix depends on which one is responsible.

In Task Manager:
- Open Task Manager and sort by CPU on the Processes tab.
- If needed, go to Details and add the PID column.
- If Service Host or WMI Provider Host (WmiPrvse.exe) is involved, note the PID.
In Resource Monitor:
- Open Start > type resmon > open Resource Monitor.
- Go to the CPU tab.
- Sort by Average CPU and watch which process stays at the top during a spike.
If System is the main offender, use Process Explorer:
- Run Process Explorer as administrator.
- Right-click System > Properties > Threads.
- Select the high-CPU thread and choose Stack to see what functions are running.
- For better stack results, configure symbols in Process Explorer by installing Debugging Tools for Windows, then in Process Explorer go to Options > Configure Symbols, and set Dbghelp.dll to C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll.
If Antimalware Service Executable (MsMpEng.exe) is one of the top consumers:
- Check whether Microsoft Defender Antivirus real-time protection is the source of the high CPU usage.
- Review other software on the machine as a possible cause first.
- If needed, use the Microsoft Defender Antivirus Performance Analyzer first, then Process Monitor, and finally Windows Performance Recorder (WPRUI or WPR command-line) if the analyzer does not identify the root cause.
If Service Host (svchost.exe) is the main source:
- This often means one hosted service is causing the spike.
- Open an elevated Command Prompt.
- Break the suspected service out into its own svchost process:
```
     sc config <service name> type= own
```
- Restart the service.
- Run:
```
     tasklist /svc
```
  to verify it is running in its own svchost process.
- Then monitor CPU again to identify the exact service.
- Important: after testing, revert it:
```
     sc config <service name> type= share
```
  then restart the service.
If WmiPrvse.exe or Winmgmt appears in the spikes:
- In Task Manager > Details, identify the PID for WmiPrvse.exe.
- Or in Task Manager > Services, locate Winmgmt, note the PID, and use Go to details.
- Then open Perfmon from an elevated command prompt.
- In Performance Monitor, add Process > ID Process for all WmiPrvse# instances.
- Then add Process > %Processor Time for the WmiPrvse# instance matching the PID consuming CPU.
- This isolates the exact WMI instance involved.
If the spikes are hard to catch, collect traces while the issue is happening:
- Collect a Performance Monitor log with a 1-second to 5-second interval.
- Collect a Windows Performance Recorder (WPR) log during the spike.
- Do not let the WPR log run for long because the file grows quickly; a few minutes is enough.
- For a singular Microsoft process, run ProcDump twice during high CPU, spaced several minutes apart.

One higher-risk case is DCOM-related svchost.exe CPU usage on virtual machines. That guidance involves deleting specific registry values and carries a serious warning that incorrect registry changes can require reinstalling Windows. That should only be considered if the issue is specifically narrowed to that scenario.

Based on the processes listed, the most likely next step is to narrow it down in this order: MsMpEng.exe, then svchost.exe service isolation, then System thread stack analysis with Process Explorer.

References: