The recent versions of the ntevl probe have both a polling and an event driven access to the logs. I don't know how long ago the complaint was made about performance but for large Windows event logs, there is a night and day difference in performance between the polling and event access methods.
I'd suggest trying the event configuration to see. I have systems with very large volumes of event logs occurring and had problems with the polling configuration. Changing to event eliminated those performance issues.
-Garin