How system utilization works

System utilization is determined when an on-demand scan starts. CPU and IO samples are taken over the first 30 seconds, then the scan is performed based on the utilization level you specified.

The system utilization you specify does not apply to encrypted files. The decryption is done by LSASS.EXE, not by the Scan32 process. Scanning encrypted files is CPU intensive, therefore even if the system limit on the scanning thread is low, it is still scanning files fast enough that LSASS.EXE must keep busy to supply the decrypted data.