Hi TB303,
Thanks for your post.
Green and red indicates that the process has just started or exited, respectively. By default, rows are only highlighted green or red for 1 second, which can make them difficult to track.
You may refer to the articles for more details.
http://www.microsoft.com/security/sir/strategy/default.aspx#!malwarecleaning_explorer
And in your scenairo, the high CPU utilisation may relate to user profiles for Citrix. Could you please save the user profile to local to check if high CPU utilisation goes down.
Here is the articles about user profile for Citrix, you may refer to.
http://support.citrix.com/article/CTX120285
And for more question about Citrix user profile for high CPU, I suggest you could also post in Citrix Forum for more support.
http://discussions.citrix.com/forum/1328-profile-management-general/
Best Regards,
Mary Dong