Very high CPU usage on one Elasticsearch data node

I am not aware of any changes in load balancing. I do however have a few additional questions.

Are you by any chance using preference for queries?

If you just look at the larger indices, how are shards distributed across the nodes? Do the nodes with higher CPU usage by any chance have more of these shards?

I also vaguely recall from previous conversations that you were considering running updates in parallel to the full rebuilding of indices. If this is the case, do the nodes with higher CPU usage have more and/or larger primary shards than the other nodes?