Can you try in 5 minute intervals sampling from the beginning of an hour until the end of the hour? So we can understand whether the CPU usage is following syslog volume.