You can gather some statistics of the usage on the filer and try to determine which volume is contributing the most to the usage and investigate from there. As mentioned above sis / dedupe and replication will contribute to the CPU usage as well.
Can you provide us the output of the command "sysstat"
Data ONTAP 8 7-Mode: sysstat -m displays per-processor and average utilization. The ANY column in sysstat -m output shows the percentage of the time that one or more CPUs were busy. In addition to this, the utilization of each individual processor is displayed, as well as the average (AVG).
Data ONTAP 8 Cluster-Mode: statistics show -category processor displays per-processor utilization for each node in the cluster. statistics show -node <nodename> -category processor displays per-processor utilization for the specified node(s).
If this post resolved your issue, help others by selecting ACCEPT AS SOLUTION or adding a KUDO.