Nit dissimilar fron RUNDLL, SVCHOST is one of those system components that are used to run (and supervise?) certain different modules (in the case of RUNDLL, not too surprisingly, the modules are DLLs.)
The inconvenient part here is that you can't easily say what the modules being run are and what they are doing. Yes, they could be malware that is busy encrypting all your files as far as the eye can see, but they could also just be indexing or compressing your files. Is there a good deal of disk activity involved? They could also be encrypting your bitlocker protected drive, completely legitimately.
Of course there could also be something running in the background where your computer is busy as part of a compute grid, computing a missile trajectory to Betelgeuse or Alpha Cantauri - or helping out with a Denial of Service Attack against the email servers of the Democratic party (or someone else ...)
Running something like Process Explorer (from Sysinternals) might show you what module each instance of SVCHOST or RUNDLL active on your computer is busy running. That might give you a clue what is going on - in most cases I look at the directory where these modules are stored and that shows me what software package this is supposed to belong to.
By the way - when you find the task manager telling you something is 50% or 25% busy, that may just be its way of saying that one of your two or four processors is maxed out at 100%, meaning that the component doing this is in a flat out spin, busy without having to wait for any disk drive or network adapter.