I know IT people often aren't given the time to dig into this stuff, but xperf and event tracing should reveal the culprit fairly quickly.

The best resource for this kind of stuff is Bruce Dawson's blog:

https://randomascii.wordpress.com/2015/09/24/etw-central/

I'm not IT, I'm' just the senior most engineer in a game studio. Ive got WPA captures that point to windows defender, even with processes and folders excluded. But I have literally no idea what to do with those traces, hence my 99% conviction.