If you open Task Manager and see svchost chewing through CPU while the service column points at DNS Client, your first instinct might be to blame Windows. That is understandable. DNS Client runs inside svchost.exe and handles name resolution for almost everything on the machine. When it spikes, the whole system feels heavy.

I ran into this on a work laptop and spent time dumping the offending svchost process with Process Explorer, reading event logs, and checking which services lived inside that host. The dump confirmed Dnscache. The surprise was what was driving it: NordPass.

The symptom pattern

1. CPU usage climbs on svchost.exe, often tagged as DNS Client in Task Manager.
2. The machine lags, fans ramp up, and battery life drops even when you are not doing much.
3. NordPass may look closed, but background components keep running.
4. On the Details tab in Task Manager, nordpass-background-app appears many times. One copy is normal. Twenty or thirty is not.
5. Event Viewer may log DNS timeouts for names like nc-mqtt.nordpass.com if lookups keep failing.

What is actually going on

NordPass runs a background app for sync, MQTT messaging, and notifications. In some setups that worker does not stay a single process. It forks again and again. Each copy tries to reach NordPass cloud endpoints. Every attempt needs a DNS lookup. Windows funnels those lookups through the DNS Client service, which lives in svchost under the Dnscache service.

So NordPass is the noisy neighbor and DNS Client is the one showing up on the meter. You are not imagining it when svchost looks guilty. It is busy, but it is busy because something upstream keeps asking for names.

A few things make it worse. VPN software can change which DNS servers the PC uses. Corporate DNS may not resolve consumer domains cleanly. Stale DNS entries on disconnected virtual adapters add retries. When lookups fail or time out, the background workers do not always back off. They try again. DNS Client does more work. CPU goes up.

How I confirmed it

Process Explorer can explode an svchost instance and show the hosted service. Mine was Dnscache on PID 1776. A minidump of that process still had dnsrslvr.dll and dnsapi.dll in play, plus live query strings for NordPass MQTT hostnames and the local AD domain.

Live checks matched the dump. Dozens of nordpass-background-app processes, each with a large accumulated CPU time. Stopping those processes dropped pressure on DNS Client within seconds.

What to do when it happens

1. Exit NordPass from the system tray, not just the main window.

2. Open Task Manager, Details tab, and end any nordpass-background-app tasks that remain.

3. Confirm svchost CPU falls.

4. Start NordPass again. You should see one background worker, not a crowd.

5. If it returns quickly, turn off background sync in NordPass settings for a while or update to the latest build.

6. If you use a VPN, test with it disconnected once. Split DNS and adapter metrics can steer queries into servers that never answer for NordPass hosts.

A note for IT teams

Users will report svchost or DNS Client. That is accurate from their view. Before chasing Windows patches or rebuilding DNS, check for a pile of NordPass background processes. A screenshot of Task Manager Details is usually enough. PTR registration errors for the internal domain and MQTT timeouts in the DNS Client log are supporting clues, not the root cause.

Bottom line

High CPU on svchost tied to DNS Client can be a real Windows issue, but it can also be an application storm reflected through the DNS stack. NordPass is one example I have verified on hardware in production use. Close it fully, kill the stray background workers, reopen once, and watch the numbers. If the pattern repeats, treat it as an application bug worth updating or escalating to NordPass support, not as mysterious Windows behavior.