in case anyone else runs into this problem, the issue is caused by Forefront's Network Inspection System.
You know how WireShark makes your system miserably slow while caching packets and analyzing them? Think the same thing, constantly running in the background. crappy metaphor but it gets the point across.
You can disable this feature within the Configmgr console here.
Launch SCCM\Assets\Endpoint Protection\Antimalware Policies. Pick the policy you'd like to change.
Next, go to Real-time Protection, and here you have a few options.
Enable Behavior Monitoring is a general heuristics engine. If your end user systems are slow when launching files, change this setting.
Monitor file and program activity is a background monitor. if you've got ancient hardware and general slowness, change this setting (but make sure you've got download and USB protection turned on, or else you're effectively disabling SCEP/FEP)
Enable Protection against network based exploits. This setting controls the Network Inspection Service of Forefront. If you're having internet issues especially, turn this off.
Hope this helps you guys!
