Wordfence has some default scans which run hourly. On many systems this works well. In at least one case we found a situation where Wordfence was running hourly scans on some VERY large libraries at the same time on multiple sites on the same server.
A fix was implemented for this, but in the time that it took us to recognize this issue, we came up with the following command which helped to kill the CPU hog so we could continue to use the WordPress websites.
kill `apachectl fullstatus|grep wordfence_doScan|awk '{print $2}'`
Some of the ways you can find out that the issue is occuring is by running some of these investigative commands
Matraex builds custom web and mobile applications. Our team of professionals can drive development of your app from vision to reality.
Boise, Idaho
Based in the cloud