For quite long time i was seeing the CPU unexpectedly jumping to 50% on a dual-core. And sometimes ColdFusion Server even was starting to not respond.
I supposed it may be the bots as there was a couple of sites on the server but still this didn't seem right. So i made sure the sessions to be ended if it was a bot, thx to the robots list (this reminds me that it's been years since i've updated that list so need to find some time to do it). But this didn't help.
As i didn't have enough time to spend on it, at that time i just made a scheduled task that at particular periods was restarting CF Server (yeah and SQL Server as well because it worth spending a couple more seconds on it but cleaning a bit the resources). This "solved" the problem except for the users that happened to access the sites at that times.
Recently i've got some available time so thought to dig some into this issue.
First i found information that this happens to some folks having CF and Symantec AntiVirus installed together. So, i uninstalled Symantec and... HAPPY ME! The spikes stopped and i removed that scheduled task. But my happiness didn't lasted long as soon i started to note that again. So, obviously the problem wasn't in that AntiVirus, or at least not only in that.
Because i had won a license of SeeFusion (thx again WebApper !!!), i thought to use it. Unfortunately it didn't work with ColdFusion 9 that was installed on the server, so i used my long-time not updated cfWatcher application. I was waiting for spikes to happen and checked running processes. In most of the cases there wasn't any cf scripts running, but on the Threads page i found scheduler-X threads being in "RUNNABLE" state. When killing them, CPU was getting to normal while CF still running. Next step was to see what exactly was that scheduler-X threads doing. Checking Thread Stack Trace i found that it was doing something with the Registry. Knowing that i have the Default Storage Mechanism for Client Sessions set to Cookie i was like HUH?!
Next i remembered about a script i used many years ago to purge client variables from Registry. It was also showing how many of them you have there. When using it i got shocked as there was something between 250K and 300K client variable records in Registry. It seems like accidentally for some time the Registry was used as Default Storage Mechanism for Client Sessions and then everyone forgot about it. So, no matter that now it was set to Cookie, ColdFusion Server still was trying to do something with those stored in Registry.
Everything left to be done was to delete all client sessions from Registry. And now there issue is solved!

So, no matter what you have set for Default Storage Mechanism for Client Sessions, if you had it as Registry before, BE SURE to remove all of them from there !

Happy codding everyone!