Exactly this, you should be able to find out the culprit using the link above.
It's unlikely to be a plugin, but if you share with us the output of htop (for example), which will show what is running the command, then we can help if you still require it.
In the meantime, if you have a firewall sitting between the server and the web, you can block the pools URL and port which should stop the CPU usage (as it won't be able to get any updates from the pool, it won't know what to mine... therefore will idle. In theory.).