set up statspack, set up snaps for every 5 minutes and this should tell you what querys are using up the most resources.

That process you showed has someone logging in over the network, you could do a netstat to see who owns that process and where the connection is coming from.

Any login triggers at all that you know of that are doing stupid things?