not sure what you mean by running in real time. By default there are twosavscand processes if on-access scanning (using Talpa) is enabled. If I'm not mistaken one handles on-access scanning, the other on-demand/scheduled scans.
There are two savscand processes for resiliency, when doing on-access using Talpa. This ensures if one crashes, the other can continue on-access scanning.
One of the processes also handles scheduled scans.
If it causes a problem, there is configuration to change the number of savscand that are kept running.
