Pretty sure ELG is indeed "Extended Log", i.e. logging separate from the main Firewall traffic logs such as $FWDIR/log/fw.log.
CPP stands for C Pre-Processor. This is a standard Linux utility that I believe performs symbol substitution during a Check Point policy compilation, taking network object names as seen in the SmartConsole and replacing them with their underlying values (IP address, network and mask, etc.). Files output from this process have a .cpp extension.
Pretty sure pf stands for policy file, and is the extension used on the file with the compiled INSPECT code. There are also intermediate files with a *.W extension that feed into the .pf files, not sure what the W stands for, maybe Working?
Attend my 60-minute "Be your Own TAC: Part Deux" Presentation
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm