You notice that wpshelper.sys driver's NDCM tag is using a large amount of nonpaged pool. You want to know if this is normal.
Wpshelper.sys is a driver used by Symantec Endpoint Protection (SEP) version 11.x Intrusion Prevention System (IPS). Wpshelper versions prior to 12.4 can use up to 100 Mb of nonpaged pool on a busy server. On a 32-bit Windows system with /3Gb switch, this sort of usage can cause instability or crash, due to running out of nonpaged pool. Wpshelper version 12.4 has reduced nonpaged pool usage to up to 60 Mb.
Wpshelper version 12.4 was released on Oct. 01, 2012.
Note: SEP 12.1 has a new IPS that doesn't use wpshelper anymore.