What can catch sporadic CPU spikes on a Windows server?

Performance Monitor can do more than show the live graph. Set up a data collector set to record overall CPU usage and Process\% Processor Time for all processes, then leave it running long enough to catch a spike. You can also configure a threshold alert, say at 85% CPU.

The process counters give you a timeline to inspect around the alert rather than having to watch the server. Choose the sampling interval with some care: very short spikes can fall between samples, while frequent logging produces more data.

If you already have a suspect process and need deeper diagnostics, look at Microsoft Sysinternals ProcDump. It can trigger a dump when that process exceeds a CPU threshold for a specified period. That's useful for investigating what the process was doing, but it isn't a general way to discover an unknown culprit.

Zabbix is worth a look if you want monitoring across all your servers. It's free, but it's a much bigger setup with a learning curve. Check how you'd collect per-process CPU data before committing, since an overall CPU alert alone won't tell you which process caused the spike.

Don't rule out the hardware side if the symptom is lag rather than a confirmed busy process. CPU power-saving states in the BIOS are worth checking on a physical host. For a VM, the host's power settings may be relevant too.