The CPU would run about 60% (2 cpu machine) so an entire cpu was consumed. Also "lsof | grep delete" would show ghost files deleted and consuming disk space.
So far, work around has been to delete the virus definition files (*.cvd) in /var/vcap/data/clamav and allow freshclam to pull new ones down and restart clamd (monit restart clamd)