had some mild panic last night when I thought my NAS had been popped by a cryptominer. it was acting strange, so I SSH'd in and found a bunch of Python processes slamming the CPU, all running as root, no jail associated. they were running code passed on the command line rather than a file, and the imports were threading related. killing them led them to come back.
in the end it turned out to be a middleware bug in TrueNAS. the code was getting stuck in a loop doing nothing.