Wordfence has some default scans which run hourly.   On many systems this works well.  In at least one case we found a situation where Wordfence was running hourly scans on some VERY large libraries at the same time on multiple sites on the same server.

A fix was implemented for this,  but in the time that it took us to recognize this issue,  we came up with the following command which helped to kill the CPU hog so we could continue to use the WordPress websites.

 kill `apachectl fullstatus|grep wordfence_doScan|awk '{print $2}'`

Some of the ways you can find out that the issue is occuring is by running some of these investigative commands

• apachectl fullstatus|grep wordfence – how many concurrent scans are running
• mysqladmin  processlist|grep wf – the number of insert / update / select commands against Word Fence tables
• vmstat 1 – run a monitor on your system to see how active you are
• uptime – see your 1 , 5 and 10 minute loads