High paging file usage, plenty of RAM available

The "Page Faults / sec" counter for each instance under the "Process" object (i.e. each process running on the box) is going to tell you which processes are creating the page faults. You can see the page faults with "Task Manager" by turning on the "Page Faults Delta" column, as well.

The problem with "Page Faults / sec" is that it includes both hard and soft (that is, page faults where the page needed is still in physical memory) faults. Soft faults aren't expensive.

You really want to see whether you're having a significant number of hard page faults (that is, page faults that have to go to the disk) or not. Watch the "Pages Input / sec" counter in the "Memory" object to get a feel for how many hard page faults are occurring.

Hard page faults occur when the memory page needed to fulfill the request must be read from disk. The "fix" for hard page faults is to add physical RAM.

Soft page faults occur when an application first writes to a new page (copy on write), asks for a page to be zeroed, or accesses a page that's already elsewhere in memory (like a memory-mapped file being used by another process). You probably can't do a lot to "fix" it if you're seeing a lot of soft page faults, but you shouldn't be too worried about them either.

You might consider running Process Explorer and looking at the threads in lsass.exe with high CPU utilization. If you've got something that's injected a DLL into the lsass.exe address-space you'll be able to see it there.

I'd echo dvogel's question about whether something / someone is attempting a brute-force password guessing attack, as well. What the network traffic moving and and out of the box (you do have "Network Monitor" installed, right?) and see if anything there looks uncharacteristic.