After you apply the Windows 2019 August Update, you observe high non-paged memory consumption in mfetp.exe. Over time, system performance degrades on systems that create large numbers of short lived processes. The Windows 2019 August Update introduced fixes for 93 vulnerabilities in its Windows application. One or more of these changes exposed an issue in Exploit Prevention. The issue in Exploit Prevention triggers a non-page pool memory leak in mfetp.exe and leaves open handles.

After you install Endpoint Detection and Response (EDR) on systems, you see general higher CPU use when you use ENS 10.6.1 July 2019 Update or earlier.
The Exploit Prevention driver has an issue that leaks memory anytime a process starts or a DLL loads. This issue leaves an entry in the table. The table grows indefinitely, which results in increasing system CPU use. EDR installs an Arbitrary Access Control (AAC) registry hook. Every time a registry read occurs, AAC iterates over every entry in the table. Over time, the table grows and every registry read requires many CPU cycles to iterate the table. Under normal conditions, the table iteration is quick and the higher CPU use issue does not occur.