CPU Increase following SEP Installation

We are running a pilot at the moment where we have removed a 3rd Party AV tool in favour of Symantec. Following the installation we have noticed a sugnificant increase in CPU, expected given the advancement of the product, but not at the level we are seeing. We have applied exclusions but these don't seem to be having the desired effect and so we are now in a state of trying to prove it's not SEP.

What can we check outside of the client and manager logs which are showing the client doing next to nothing to dissprove the perception that SEP is to blame?

Thanks