I don't believe CPU history of Sophos (or any other) processes is stored in the data lake.
You can use Live Discover to query CPU usage (total system CPU usage %, as well as CPU time by process) directly from endpoints in real time. And you could potentially automate that on a schedule and create your own history database using the API.
