We have just recently discovered that if we send a job to the affected computers to rip out the KAV component (Patch & Compliance Security Component Settings Task), let the system restart, then send another job to reinstall it, it seems to improve the situation. The KAV scans still take a lot of resources, but there is just enough to not lock up the system. There is something left over from previous installs that we feel is causing it to misbehave. We have seen this issue on systems with 9.5 SP2 that were upgraded to 9.6 SP1, and on systems that were imaged and had 9.6 installed, then upgraded to 9.6 SP1. We have also seen a couple freshly imaged systems that started out with 9.6 SP1.
Long ago we had the issue that was fixed by the component patch in 9.5. This issue, while it presents itself the same, for us is different and it is affecting a small percentage of systems on 9.6 SP1.