Hello,
 
Just for a little light reading material - I bookmarked the following a few months back to help me keep track of the various domains:
 
https://kb.netapp.com/support/s/article/ka21A0000000fzcQAA/faq-cpu-utilization-in-data-ontap-scheduling-and-monitoring?language=en_US
 
That said, I vaguely recall us working a case a long time ago (7mode - 8.0.x) where we had an nSanity gather going against an Exchange host and our filers.  Anyway, with 8.0, Kahuna would manifest itself on a single core which would skew our ANY statistic.  What I remember is that during the nSanity gather (and during a subsequent perfstat gather) we'd see that Kahuna-owned core spike in relation to whatever performance gather we had going on.  I don't know how that behavior translates into ONTAP, but it makes me suspect that monitoring gets reflected more in the Kahuna/wafl_ex domains vs. the HostOS.
 
We have a relatively quiet 8.3 cluster that we're in the process of decommissioning.  If I have time I'll fire up a perfstat against it and see what domain is getting the business.
 
Regards,
 
Chris