I have never been a fan of the out of the box alert for high CPU in Orion. It is a static value and in no installation I have ever worked on, has a single value been appropriate for all devices.
This alert definition uses the Critical threshold value, for which you can specifity at the global level (Settings > Orion Thresholds) or at the Node object level (Edit Node). This gives much greater control over the correct alert condition for each device.
Within the settings, you will see I have a delay on trigger of 21 minutes (i.e. 3 polls at default intervals) and only reset if the device is not in warning or critical and it has been that way for 30 minutes, so as to avoid alert flapping
