I traced the instruction calls going through SMB. I identified lots of calls going to getdents64. I tracked this down to be the call to scan a directory for files. I then searched for directories with large numbers of files. Found one, an uploads directory, with 25K files. I reduced the directory size and CPU has gone back down to a sane level.