Thanks for the link. It looks like either Process Explorer or the tasklist /SVC command might be able to help me pinpoint which service is running behind that svchost process.
I'll give it a try the next time it decides to start its excessive file reading
.