The server showed high utilization (server thread) and was sluggish/unresponsive from clients. It would not shut down cleanly, so a reboot was forced. The last file scanned by Sophos was at 11:07, which seems like a large time gap. Server is operational following the reboot.