The SymDaemon process may consume a high amount of CPU in Symantec Endpoint Protection (SEP) for Mac.
This can be caused by compressed file scanning in SEP for Mac, and some relief may be obtained by disabling compressed file scanning where it is unnecessary.
Compressed file scanning is typically not recommended, especially for AutoProtect. Extra CPU resources are required to decompress and examine such files. If there are any risks in compressed files, they do not present a threat unless decompressed. In that case SEP AutoProtect scanning would catch the risk if the file was decompressed during normal file operations.
See How to Disable Scanning of Compressed Archives in SEP for Mac
If compressed file scanning has been disabled and symptoms persist, please open a case with Symantec Technical support. Enable symdaemon debug logging and gather the following data when SymDaemon CPU usage is high:
Use the most current version of SEP for Mac.