I couldn't get this alert to work in our environment, and I've been trying to solve a rogue process and remove VNC as the suspected process... I found this script tonight, and will be working that into a monitor this week:
Get-Counter -computername $IP_Address '\Process(*)\% Processor Time' | Select-Object -ExpandProperty countersamples | Select-Object -Property instancename, cookedvalue| Sort-Object -Property cookedvalue -Descending| Select-Object -First 10| ft -AutoSize
Most of what I see looks like I need to take a sample interval, but this seems to get me what I want without that. I'll come back and update if I can make this work.