Pretty sure ELG is indeed "Extended Log", i.e. logging separate from the main Firewall traffic logs such as $FWDIR/log/fw.log.
CPP stands for C Pre-Processor. This is a standard Linux utility that I believe performs symbol substitution during a Check Point policy compilation, taking network object names as seen in the SmartConsole and replacing them with their underlying values (IP address, network and mask, etc.). Files output from this process have a .cpp extension.
Pretty sure pf stands for policy file, and is the extension used on the file with the compiled INSPECT code. There are also intermediate files with a *.W extension that feed into the .pf files, not sure what the W stands for, maybe Working?
Attend my online "Be your Own TAC: Part Deux" CheckMates event
March 27th with sessions for both the EMEA and Americas time zones