Defwatch scan are taking too long to complete and using too many resources.
Symantec Endpoint Protection (SEP)
Examination of the Symantec Endpoint Protection (SEP) Client AV.Log shows two (2) Defwatch scans occurring at the same time.
Both 32bit and 64bit SEP drivers are loaded.
A previous Windows 2003 32bit server was upgraded to a Windows 2008 R2 64bit server. The upgrade of SEP from 32bit to 64bit did not successfully remove all the 32bit SEP version.
Remove SEP with Windows Programs and Features and reinstall the correct version.