I've had this before, check you can reach the syslog server and port from the connection server where you're configuring the syslog target.
Also, depending on the implementation of syslog, do you have it configured to allow connections from the Connection Server?
I've seen CPU run high in cases where tunnelling is enabled on the Connection Server with larger environments, but that is to be expected depending on connection count...
What processes in task manager are you seeing that are high?
If you using DEM why not try creating a condition for a security group that when they log in, it drops a shortcut to Onedrive in the startup folder to see if that works.