I suspect that you are seeing a combination of perhaps several things:
1)--you probably have scheduled scanning set to do a full, rather than quick
scan. I'd recommend changing this to a quick scan and doing full scans
eithter occasionally, manually, or when something is found by the quick
scan.
2) related to 1, Windows Defender will initiate a background scan when a
scheduled scan has been missed. I believe this happens 20 minutes after the
succeeding logon.
3) I've seen some reports that particular antivirus real-time protection,
in combination with Defender, can result in high CPU usage, again, during
scanning--so experimenting with scanning with and without real-time
protection from your antivirus might be instructive.
I certainly wouldn't advocate turning off real-time antivirus canning, but
if you reserve full scans for manual use when the machine isn't doing work
for you, this may be more bearable.
The quick scan is intelligent--it starts with what is in ram, and the
startup locations, and works outward--and should catch anything which is
actively running.
