Calendars: It is possible that a huge calendar folder can cause CPU issues. Look into your users calendars to see if they are huge. If so, have that user log off and see if CPU usage goes down.
Debug logging: In some cases, the debug log provides most of the clues. Right-click over the debug log then choose "Set log events..." or "Messages...". A pop-up dialog appears in which you can select various types of debug logging. Choose "folder operations" and see if it scrolls like crazy with folder operations for only one user. Try SMTP, IMAP, HTTP, etc. See if anything suspicious appears. You will know if something is suspicious if the logs scroll hundreds of items in a single second, and they all appear to be for the same operation. Some sort of infinite loop can be detected this way perhaps.
Network Trace: Gather about 10 seconds of network trace output using a tool such as "ethereal" or "tcpdump". A network trace might show many small packets seemingly attacking the mailserver. Send it to Kerio technical support for analysis (and explain why you are sending it!).
Crash dumps: Get a crash dump while the problem is happening. Call technical support and explain the problem, and ask how to get a crash dump for the mailserver on your operating system, and where you can upload the crashdump to.