Need to see the Parent Process ID (PPID) of those strange processes to help figure out what they are, easiest way is to post output of command "pstree".
Or you can run "ps -ef", the first number shown is Process ID, second number shown is Parent Process ID (PPID). Once you have PPID of the mysterious process try "ps -ef | grep PPID", then look at the parent process ID of that process, rinse, repeat...
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.
New 2-day Live "Max Power" Series Course Now Available:
"Gateway Performance Optimization R81.20" at maxpowerfirewalls.com