If it's predictable, then I'd recommend you engage NetApp support and they'll have you collect perfstat and they can tell you. If you want to go the DIY route AND you have DFM/OCUM(I'm guessing you might, since you're getting alerts) in place, then you may be able to match the high CPU time to some activity on your filer(like someone running a full table scan on a DB sitting on one of your volumes, for example). This would show up in volume:total_ops and/or volume:throughput. You can do this using the NMC or DFM CLI.
If you go the DIY route, then I'd watch the latency numbers over CPU number personally, especially if you're using DFM/OCUM. Also, considering you're on an 8.1.x release, you should make sure you're watching system:avg_proessor_busy(or processor:processor_busy) and not system:cpu_busy. The latter will report higher numbers and will have less correlation with latencies compared to avg_processor_busy. That's just my observation so YMMV.