Intermittent 100% CPU usage by ccSvcHst.exe in a virtual machine with a single CPU core and Symantec Endpoint Protection (SEP) 14.0 (MP1, MP2). This lasts for about 5 to 7 minutes.
While internal testing did not reveal any performance issue on single core virtual servers, it was determined empirically that unknown environmental conditions on such a system may cause the RegSetValueExA Windows API function to finish 10000 times more slowly than normal. Because SEP waits for the completion of this API call in an endless loop, it results in high CPU usage (for single core systems only). The delay amounts to 6 minutes.
SEP 14.0 (MP1, MP2)
This issue has been resolved in Symantec Endpoint Protection 14 RU1 or later, by preventing the endless loop that lead to the high CPU usage. Alternatively, adding another core to the virtual machine will avoid the issue.