I don't know.  I do know it is hard to find out.  Svchost.exe runs loads of services that hide in DLL's.  Because of this 'flexibility' I don't know a way of identifying which one is the culprit when it runs amok.  It will be especially difficult if it is unpredictable.

It is possible (note I did not say easy, safe or quick) to reconfigure those services by making registry changes so that one instance of svchost runs one service.  You then have a chance of seeing which ones are greedy and identifying the one that runs amok. 

If it is something that always goes bad (not your case) then you can use MSCONFIG (click Start | Run and type MSCONFIG) to turn off things that are not critical until you identify the bad one.

I have heard of svchost going to 99% being associated with the "Microsoft Update" service.  I could not recommend not using MS Update.  I would have thought that if Norton has their own service program (ccSvcHst.exe) then it would be unlikely they would need to inject their own code into SvcHost.  OTOH it is possible that the Norton program is requesting a greedy slice of a service that SvcHost does deliver.

I have also heard SvcHost implicated with networking.  Does it go away if you pull out the network cable?

Does your machine eventually settle if you leave it?  Or is your only choice to restart it?

I have a bit of code; it came from a friend; that goes through the svchost related registry entries and reconfigures them not to share.  This should give a fighting chance of being able to identify the service that pegs your CPU.  One consequence is that you will have *many* more instances of svchost whilst you track this down.

I've never run this bit of code.  It comes with no guarantees although when I glanced through it the comments sounded reasonable.  It does open heart surgery on the registry, and a critical part of the registry. I would not run it unless I was confident that I could recover my machine if it happened to get totalled.