8:17pm up 1:24, 1 user, load average: 11.89, 11.71, 8.86
249 processes: 231 sleeping, 5 running, 9 zombie, 4 stopped
CPU states: 29.6% user, 12.3% system, 0.1% nice, 57.8% idle
Mem: 1030560K av, 1009524K used, 21036K free, 0K shrd, 14800K buff
Swap: 2048276K av, 919368K used, 1128908K free 124032K cached

PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND
10461 cpanel 25 0 883M 385M 352M R 0 61.4 38.2 4:54 php


any idea of what can it be ?

try running top from ssh, it will show exactly whats using all of the power. Unless you have a xeon your loads need to not much higher then 1 (and below on for most of the time)

that's what i did... top from ssh
i got a xeon.

just i pasted the first line cause it was a over 90% of use

I checked on two different servers and did not find a process named "php". I would first see what this php program is, perhaps run chrootkit. I am trying to think but I have never seen a php program and the php that is used in apache is just a module.