I suspect Sophos is following symbolic links when scanning and that this may lead to cycles of always scanning the same files over and over again. On a raid system with about 9 million files on the system, Sophos was still running 3 days later after scanning…