I am currently testing out VM's in Azure, but I am running into a little problem. After a while (1-2 hours after boot), my VM's suddenly become very slow, because lsass.exe (and/or sometimes also services.exe and/or one of the svchost's) take all available CPU. Sometimes I cannot even do a regular shutdown of a VM in that state. I have tried everything I know to figure out, why they are doing this and stop it, but I can't.
My VM's are Windows Clients (WX 1709) with 1 and 2 GB of ram. Not much, but I don't need much, and I suppose it should be possible to run machines that small.
I had a very similar issue, seeing high CPU load on either lsass.exe or Windows Anti-Malware component. After several reboots, I could see that there was also a high CPU load for the OneDriveSetup.exe which had somehow gotten downloaded to my VM.
By killing that process and uninstalling OneDrive I seem to have been able to solve the problem, at least for now.
I had the problem on a fresh and clean VM, and I never saw any trace of OneDrive, BUT after a few tests, I concluded that less than 4GB of memory (1GB/2GB, 1 cpu) would always cause the problem. As soon as I increased the size to 4GB, 2 cpu, the problem went away - on the same VM, and 1 or 2 others, I tried with as well.
I am a bit puzzled, that MS offers the small sizes at all, if they don't work. Perhaps they are not even aware of it yet, if the problem has only appeared recently in Windows 10.