I don't recall seeing significant locking in the stack samples, just that the scanning happens synchronously during some IO (e.g. closing file handles) and >90%

I don't recall seeing significant locking in the stack samples, just that the scanning happens synchronously during some IO (e.g. closing file handles) and >90% of the CPU cycles are spent on defender. Which effectively boils down to a task that should be IO-bound becoming bottlenecked by waiting on defender.