It's rather difficult to say, there could be a backup running or a (few) queries. For example a count aggregation query has quite some resource usage. However, most of these actions would require some kind of action in order for them to be run.
We also have to realize that when you are writing alarms to Elastic, this could also cause CPU spikes. Every now and then Elastic will do a "force merge", which could be compared to a mini compaction in Cassandra.