Avoid using the NOT comparison if possible. Also, use INTERNAL attributes whenever available.
Why am I getting Global Collection CPU threshold exceeded alerts in SPECTRUM?
Global Collection CPU threshold exceeded alert
BEST Practices: Global Collection Searches
Also reference TS28580
Causes of this problem:
This can be caused by excessive "NOT" statements in the Global Collection Search criteria. The way the "NOT" criteria works is less efficient and creates higher load in processing than the other statements do. This is because first, SPECTRUM searches the database and collects ALL objects relevant for evaluation of the criteria (whether they are = or not =), then it identifies the objects within that group that meet the EQUAL criteria, and finally, it subtracts those identified meeting the EQUAL criteria from the ALL collection of objects to get the "NOT = " objects.
Internal attributes enable SPECTRUM to more quickly get the values used for computation.
(Legacy KB ID CNC TS30415 )