What is the trigger delay for this alert? If you have it set to "0 second", then it's going to be difficult to catch the culprit since it has to spike CPU for such a small amount of time.
By setting a trigger delay, you ensure that a process has been spiking CPU for a longer duration, and is therefore more likely to be caught.
In addition, your delay should be MORE than a multiple of the polling interval. The default polling interval is 5 minutes, so anything less than 5, 10, 15, etc. is just going to alert on the same poll value, but delayed.