<p>I reproduced this using Windows Defender. It seems that saving the AV cache files in ProgramData is mostly responsible for the increase of used up System Restore space. So the first scan sees the largest increase and consecutive scans show less increase and less SYSTEM write operations.</p>
<p>Test using DisableLastAccess seem to indicate that growth and writes are higher when last access times are enabled. It also seems that not only are some folder access times not updates, but also some file access times. This needs more testing, though.</p>
<p>And then there is still the case where I saw AVP.exe write to scanned folders directly. This does not happen every time and I have to catch it again.</p>
<p>Apart from all that highest drive utilization seem to happen when AVP writes its tempio files. It would be interesting to see what happens if AVP would write all its temp files and preliminary cache files to appdata/local/temp or Windows/temp and only copy finished cache files over to ProgramData.</p>

<p>The original issue of KES scanning slower than KIS was solved by disabling the trace files. So there is nothing more to analyze or is there?</p>
<p>KES/KIS only using a limited number of CPU threads/cores seems to be a deliberate choice by your developers. You would have to ask your developers if this is by design or maybe a bug. Additional threads are used for real-time scans so overall KES is capable of using more, it just does not do so for on-demand scans.</p>