The link from EugeneZ looked interesting, but it referred to other threads and those links were broken.
The link to SQL tips looked good, and was following that. But with the server reboot, things have settled back down and minimal to no cpu activity by SQL. Cumulatively, its still second to idle, but was showing 0% when I checked.
I've heard of replacements for sp_who and sp_who2. I may check them out.
I'd like to keep the question open for a few more days and I'll post what I find after the weekend/feedback from business unit owner.
check what process is taking cpu in taskmanager ( it could be AV)