another tracks : - if you are on 4.2, try the 4.2 Universalforwarder, that is minimalistic. - be very specific in your path to monitor to reduce the number of path to check. (event before using white or blacklisting)
If it is windows light forwarder, you can also specifically disable the scripted inputs for wmi and regmon in system/default. This will remove two extra processes, but splunkd is still the heavy.