Usually we see this when there is a logmon probe that is monitoring a very busy log file or a very large number of log files
or with ntevl doing the same.
usually this is because these probes are updating the last position to a local file.
What other probes are is on the problem machine?