What is the cause of a high CPU usage of 'system and compressed memory' in Windows 10?

Analyzing the ETL file with WPA shows, that the CPU usage doesn't come from system memory compression. It comes from ntoskrnl.exe!MiScrubMemoryWorker:

Line #, DPC/ISR, Process, Stack Tag, Stack, Count, TimeStamp (s), % Weight
8, , , ,    |    |    |- ntoskrnl.exe!MiScrubMemoryWorker, 79667, , 12,45
9, , , ,    |    |    |    ntoskrnl.exe!MiScrubNode, 79667, , 12,45
10, , , ,   |    |    |    ntoskrnl.exe!MiScrubNodeLargePages, 79667, , 12,45
11, , , ,   |    |    |    ntoskrnl.exe!MiScrubNodeLargePageList, 79667, , 12,45
12, , , ,   |    |    |    |- ntoskrnl.exe!MiScrubPage, 79663, , 12,45
13, , , ,   |    |    |    |    |- ntoskrnl.exe!RtlScrubMemory, 79653, , 12,45
14, , , ,   |    |    |    |    |    |- ntoskrnl.exe!RtlpGenericRandomPatternWorker, 38549, , 6,02

This is a function to test the memory for errors by filling / reading some patterns (ntoskrnl.exe!RtlpGenericRandomPatternWorker).

This is by design and happens when the idle maintenance task kicks up when your device is idle.

First, re. CPU usage: The "System and compressed memory" process (it's not a service) performs many functions. Just because you see it using CPU time does not mean it is doing work compressing memory contents. To find out, use Process Explorer to find the name(s) of the thread function(s) in the process that is (are) using CPU time. You'll need to configure symbols in Process Explorer to do this, as described in this answer.

The memory that is being compressed is memory that was

• part of the private working set of a process (i.e. shared with any other process); and
• modified while it was in that process; and
• subsequently lost from the process due to page replacement, and put on the Modified page list. (This algorithm has not been substantially changed for Windows 10. You're not getting any more page replacement then you used to.)

Now... if you don't have a pagefile, it will just stay on the modified page list (until the process ends). (Please note: Disabling your pagefile will not change the behavior so far described.)

If you do have a pagefile (which is, of course, highly recommended), the behavior differs between Windows 10 and prior versions.

• Prior to Windows 10, it would have soon been written to the pagefile and the physical pages would be moved to the Standby page list. This is done by a "modified page writer" thread in the System process.

• With Windows 10, it's first compressed (taking around half as much room as it used to) and stashed in the user mode address space of the System process (now called "System and compressed memory"). If necessary to free up memory it can then be written to the pagefile and released for other use. (Note that the benefits of space compression apply to pagefile space and I/O time too.)

So, really, this is a good thing. However much additional memory you see used by the System process, well, prior to Windows 10, about twice that much would have been on the modified page list or standby list. Certainly it will not take any more space than it used to.

You can (per my recent tests) disable this mechanism by getting rid of your pagefile, but this will not affect the page replacement behavior; modified private pages pushed out of processes will simply be ineligible from being freed for other use, and instead of being in the System process the memory (about twice as much of it) will just sit on the MPL.

It may be the "Killer Network Manager" software. If you uninstall it, the issue goes away, but so does network as it uninstalls the network adapter drivers as well. The good new is, there is a fix.

First, go to http://www.killernetworking.com/support/driver-downloads/item/killer-suite and download the new version, but do not install it yet. Just save it and know where the file is located.

Then, uninstall the current version through the control panel. You will have to restart the computer. Once the computer is back up, run the new software installer. The new version that was released January 2016, doesn't seem to have that same issue.

I think the old version of the software has a memory leak causing this issue.

Just a FYI, the "Killer Network Manager" software is part of Qualcomms Aethos Killer Wireless-AC / Wireless-N and wired E2200 / E2400 network cards. Without the software, you have no internet.