I encountered an identical situation, for me it was confusing, as I tried everything,
1. I had my hosting company conduct a security audit on my dedicated server, nothing came out
2. Examined online traffic using various tools, nothing came out.
3. Created a clone copy of the installation, nothing came out.
4. Carried a comprehensive virus scan, nothing came out.
5. Examined the server events log, nothing came out.
6. Increased the RAM and Core, still did not help a bit .
I had someone examine the dump file live with full admin access, and in less than two hours was able to pin-point the troublesome method from a third party module.
I immediately had the vendor fix it.
From my experience the high CPU usage by the IIS worker process is mainly due to third party modules.