My first thoughts are to 1. Check for browser plug-ins.
2. Also check which apps are active, see if there's any you do not recognise.
3. Check which apps are utilising the internet. I'm not certain how to do that on Windows.

I am aware some security apps, particularly some brands of AV can be incredibly CPU demanding. There might be an issue with an AV settings needing to be curbed from analysing every single activity but only for new items. That kind of thing.