

This can happen when a computer first boots up or it can happen at any time after that. Windows Defender on the other hand will set these counters to "mode 2", at what looks like random intervals, for random durations of time. Popular system utilities like HWiNFO, OCCT, Core Temp, and ThrottleStop, all set these counters to "mode 3" or "All-Ring Levels." Since they all set the same mode, there's no issues with multiple programs using the same counter.

Since these counters are a shared resource, it is possible that multiple programs want to access these counters at the same time. Each of these counters can be programmed in one of four modes, to configure at which privilege level it counts-Disabled, OS (ring-0), User (ring>0), and All-Ring levels. The underlying issue that costs so much performance is that Windows Defender will randomly start using all seven hardware performance counters provided by Intel Core processors, which includes three fixed function counters.
