Hi @ANLYNG ,
probably not related, but you can look at https://support.sas.com/kb/66/077.html Has viya got the latest updates?
Now, what I would do: you can start with a full exclusion of /opt/sas/viya to see if this helps on itself. You could exclude also where the (external) data resides, but I hope you already have exclusions for those as recommended for SAS 9.
If this helps, then you know where your antivirus keeps busy, that that probably would be on the changing files: the log files and the CAS tables (and temporary CAS ones). Then you can try to remove /opt/sas/viya and add those file extentions.
I hope it helps.
Best regards,
Juan