Long-lived access tokens are only required for Node-RED running on a separate machine (and other clients that require inbound access to HA and/or an add-on). When NR is installed as an add-on it uses the controlling supervisor to proxy between containers and no tokens are required.
Short-term tokens are auto generated to support web browser access on the local network. HA does not permit access to anything without first logging in, which generates these tokens.
In terms of NR hogging the CPU -
NR runs under node.js as single-thread. node is normally very robust except when it runs out of memory and the garbage collector takes over. If node is hogging the CPU then NR would not be running, so assuming NR is actually working, that is not the problem.
Node-RED, as the main runtime, runs the execution engine to run the flows, and the server. Flows execute by handing over to the JS in each node to run the node, and NR waits until the node finishes. Hence any node that gets stuck will hog the execution (and NR). There is an element of asynchronous processing where nodes can return control to the execution queue, but remain alive eg waiting for an http call return. Badly behaved nodes will not tidy up and kill promises and timers, which can be an issue on redeployment when running flows need to be shutdown and recreated.
The NR server supports the editor (which runs in another machine browser), and there may well be other server configuration nodes running also. These may have keep-alive. My Modbus Server nodes go to sleep, as does the HA WebSocket server, but some provide a ‘keep alive’ heart beat option. Generally the servers should be quiescent between actual use.
If NR is responsive, and no flows are running, yet the CPU is consumed, my assumption would be that node is ok, the execution queue is ok, but that a server is hogging in the background. So, perhaps going through the configuration node list and disabling each ‘server’ node to see if that is the cause.
Of course, looking at my machine, the one component not yet mentioned that comes to mind is the HA installed Node Red Companion, currently v4.1.2 (updated to v4+ middle of last year). This probably communicates back and forth with the HA (WebSocket) server, and between them they deal with registering new entities with HA. If your companion requires updating it may be that, on start up, the HA server and companion are attempting to re-register all the NR created entities, are having issues, and are just going around in circles.
After that, I have absolutely no idea.