Hello
- Isolate the svchost to its own svchost.
Sc config winrm start= disabled
Net stop winrm
Sc config winrm type= own
Sc config winrm start= auto
Net start winrm
- Use the vmmap to check the memory usage.
VMMap - Sysinternals | Microsoft Learn
- Based on the memory usage then collect the log.
The following link may be useful.
WMI: High Memory Usage by WMI Service or Wmiprvse.exe - Microsoft Community Hub