On my test Windows Server 2008 R2 Server Core install, I’ve been seeing period CPU usage spikes on what’s basically an idle guest. Task Manager showed an instance of svchost was the offender. I used Process Explorer to narrow down which services it was running. From there, I had to use the process of elimination to find the CPU hog.
I started by disabling the Windows Update service. Even though that turned out not to be the problem, I stand by that. There’s no reason to have a service running when we’re going to run the updates manually.
It seems the IP Helper (iphlpsvc) service was the culprit. Some web searching suggests it’s used for 6to4 (or Teredo) tunneling. We’re not interested in host-tunneled IPv6 connectivity; eventually I want native IPv6. So, I just disabled the service. The guest’s idle CPU usage seems to hover around 1% now.