Joe,Cool. Although you do seem to have about 5% "missing" meaning system jobs are eating your CPU. But if hits aren't causing that much load anymore, then you may be right that you were in the midst of an "anomalous event" <grin>.
I am not a performance guru by any stretch and perhaps looking at WRKACTJOB is the wrong way to go about determining "load". Here is a screen shot: http://www.petesworkshop.com/i/wrkactjob.jpg . All other jobs listed below this shot show 0 CPU usage. When I hit the site now, there is no change in overall CPU utilization so perhaps yesterday's events were anomaly. In any case, the http filtering stopped whatever events were sapping the CPU.