EtreCheck flags Apple processes; what should I do?

First, there is no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac.  This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.  

There are no known viruses, i.e. self propagating, for Macs.  There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.   

Anti Virus developers try to group all types as viruses into their ad campaigns of fear.  They do a poor job of the detecting and isolating the adware and malware.  Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.

There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and remove it.  The free version is more than adequate for most users.  

Unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they provide false security from a privacy standpoint.  Read these two articles: Public VPN's are anything but private and Security Risks: The Dangers of Using Free VPNs (eccu.edu).

That being said you should uninstall, according to the developers' instructions, the following: AdBlock, DuckDuckGo and Cloudflare Warp. That is unless they are company mandated apps to have installed.

You can check to see if you've removed all of the supporting files by downloading and running the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For the mentioned software you'd do the following search(es): 

1 - Name contains adblock

2 - Name contains Cloudflare

3 - Name contains warp

4 - Name contains vpn

5 - Name contains duckduckgo

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  

If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode according to How to use safe mode on your Mac and delete from there.

Note:  if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode.  This makes it act as a wired keyboard as will assure a successful boot into Safe Mode.

Another possible and potential issue from that report

Secure Boot: Reduced Security

Use macOS Recovery on a Mac with Apple silicon

Important element from this link

Change the security policy

1. Start up your computer in macOS Recovery.
2. In the Recovery app, choose Utilities > Startup Security Utility.
3. Select the system you want to use to set the security policy.
4. If the disk is encrypted, click Unlock, enter the password, then click Unlock.
5. Click Security Policy.
6. Select one of the following security options:

• • Full Security: Ensures that only your current OS, or signed operating system software currently trusted by Apple, can run. This mode requires a network connection at software installation time.
  • Reduced Security: Allows any version of signed operating system software ever trusted by Apple to run.

1. If you selected Reduced Security, select any of the following options, if needed:

• • Allow user management of kernel extensions from identified developers: Allow installation of software that uses legacy kernel extensions.
  • Allow remote management of kernel extensions and automatic software updates: Authorize remote management of legacy kernel extensions and software updates using a mobile device management (MDM) solution.

1. Click OK.
2. If you changed the security policy, click the User pop-up menu, choose an administrator account, enter the password for the administrator account, then click OK.
3. Choose Apple menu  > Restart.
4. You must restart your Mac for the changes to take effect.

FibreMan_85_125 wrote:

Will that provide an answer?

Very likely but no guarantee. Copy the report as shown in this animated screenshot

and use the Additional Text button to paste the report in your reply.

Then we can examine the report and see if we can determine the cause of the problem.

FibreMan_85_125 wrote:

Will that provide an answer?

We can't be sure to find an answer, but for sure we can't help without seeing the report.

Note: the report shows that these processes are using a lot of CPU (this you have shown us), but also it tells what mac model, what OS, how full your drives are, what system extensions, launch daemons, and agents are installed, etc. All that may play a part.

Post the etrecheck report so that we can see it.

There are not any obvious huge red flags in the report.

A word of caution:

I would not use any vpn unless as a true tunnel to connect to a work or school network, as per their instructions.

Public VPN do not offer the sort of protection that a lot of people seem to think they do.

I noticed that some of the crashes involve fileproviderd, which means they might have to do with stuff like dropbox or onedrive, but alas there is nothing definitively pointing to any precise cause.

How much different is this than a typical M1 Pro running 15.3.1, considering that it is logged in to an iCloud+ account and synced with an iPhone running iOS 18.3.1?

I don't have an M1 Pro, but I do have an M1 Mini and an M2 MacBook Pro. I don't install system modifications on my Macs, much less a metric crap-ton of them (everything is relative to your point of view). Most of yours appear to be completely (perhaps only moderately) superfluous.

As I haven't run EtreCheck in quite a while (I only need to when I need to explain how it functions to someone here), I ran it to answer the above quoted question (see, that's what I mean by I only ever need to run it to help someone here).

Yes, all of the new Apple intelligence things are using high CPU (I hope that doesn't surprise you).

Much like people, lsd seems to crash on macOS.

Back to the original question:

I updated to Sequoia 15.3.1 afew days ago, so ran Etrecheck to see if anything was needed.

I guess I can understand with the plethora of system modifications installed why you would want to look for problems caused by them after updating, but that's really not the purpose of EtreCheck. The only thing I would expect it to find in that case is the inordinate amount of system modifications you have installed.

FibreMan_85_125 wrote:

Will that provide an answer?

It will give us more context and knowledge of your system and possibly allow us to see what is causing issues.

dThe report doesn't say what is causing your problem but does show what is installed and, from experience here, is unnecessary.

If you don't need those apps uninstall them. Try Safe Mode for the installation.

FibreMan_85_125 wrote:

EtreCheck flags Apple processes; what should I do?

Just to clarify, EtreCheck isn't flagging any Apple processes. It is the operating system that is issuing those diagnostic reports. EtreCheck is just showing them to you.

Whether they are a problem or not is a different question. Please identify what specific problems you are having with this computer. So far, you haven't said much other than "video issues". In your EtreCheck description, you went a little further:

video misbehavior — SwitchResX?

cursor reluctant to change to correct value

I'm not sure what any of that means. You seem to have 3rd party system modifications that attempt to modify the default behaviour. If 3rd party system modifications aren't working properly, you should contact their developers directly. Generally speaking, those kinds of system modifications cause the vast majority of problems that people report here in the forums.

FibreMan_85_125 wrote:

I think Etrecheck added some windage: "There have been numerous app crashes.", and "There have been numerous cases of apps with heavy CPU usage."

That's true. EtreCheck just reports what it finds. It if find something that can be related to a specific problem, then it says so. But it shouldn't hide things if they can't be tied to a specific problem.

What I was hoping to learn was what might have been causing my (internal) monitor display to go on, then off, maybe on again, etc. shortly after the system was waking or booting. That started shortly after updating SRX to the latest, but that was also around the time the OS updated. I've had several exchanges with Stephane Madrau; he said he's been using it without issue. He kindly provided a link to the prior version, which I might revert to if it keeps occurring. I've found a workaround that's not too onerous.

Basic troubleshooting for this kind of problem is to uninstall any software that could potentially be related. SwitchResX definitely applies. I would say that the OWC Dock Ejector is also a candidate. Uninstall them both and see if the problem goes away.

The "cursor" mention is about a minor annoyance: I wonder how is it that with all the power of an M1 Pro, the OS fails to quickly change the cursor to the appropriate type (like Macs "used to" 😆), no matter how long one hovers over a spot. I'm often left wondering what exactly is going to happen if I click?

Does this happen in just one app? Usually, apps are responsible for tracking cursor changes when they're active. But it's kind of tricky, so I wouldn't be surprised if certain apps don't do it properly.