this has narrowed down the scope greatly.
most likely a rule caused 100% CPU, now need figure out which rule.
what mod_security rule set are you using ?
to figure out which rule, I think you can enable half of all the rules. if no 100% CPU issue, then the problem rule should exist in another...