Glossary
scrcons.exe (WMI Standard Event Consumer)
The Windows process that runs ActiveScriptEventConsumer scripts. Seeing it run, or its children, points to a WMI script subscription.
scrcons.exe, in C:\Windows\System32\wbem, is the WMI Standard Event Consumer host for scripting: it runs the VBScript or JScript of an ActiveScriptEventConsumer as SYSTEM.
On most systems it rarely runs, so its execution (Prefetch, process creation events) or child processes are a useful lead. Check the repository for a script consumer and its binding, live or recovered. See the investigation checklist.