Run following search
index=_internal source=*metrics.log* ratio > 0.8| timechart max(ratio) by thread
Search will show threads using higher cpu.
If one of the thread is SplunkConfigChangeWatcherThread, then disable new splunk config change tracker feature.
In server.conf
[config_change_tracker]
disabled = true
