Synology?
SSH in and run top. See what it's doing. You could compare the checksum of the binaries that are running to make sure that they're the real binaries, if you really want to get into it.
But if I had to guess, it's either running a backup or re-running its indexing.