Pretty sure ELG is indeed "Extended Log", i.e. logging separate from the main Firewall traffic logs such as $FWDIR/log/fw.log.
CPP stands for C Pre-Processor. This is a standard Linux utility that I believe performs symbol substitution during a Check Point policy compilation, taking network object names as seen in the SmartConsole and replacing them with their underlying values (IP address, network and mask, etc.). Files output from this process have a .cpp extension.
Pretty sure pf stands for policy file, and is the extension used on the file with the compiled INSPECT code. There are also intermediate files with a *.W extension that feed into the .pf files, not sure what the W stands for, maybe Working?
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com