Of course I'd sort it out right after posting...
I used process monitor to figure out what it was doing. Turns out an infinite loop of looking for HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\virtualization. I tried creating that as an empty string, and then it polled for C:\Windows\Globalization\virtualization.nlx.
Turns out this is a broken Intel Proset driver. Removed it & the system is back to normal. Who would have figured a network driver would spam a user profile service? Sigh....
- Joe