Too Many winlogon.exe LogonUI.exe csrss.exe open on server?
I just had the same problem on one of my servers - it turned out to be caused by an attempt to get into the server through Remote Desktop/Terminal Services - either a brute-force or massive dictionary attack (every RDP logon attempt causes LogonUI to spawn). Check your System and Security event logs, they'll contain more information (such as the originating IP of any failed remote logon attempts).
I found it was the morto virus
http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus:Win32/Morto.A
Malwarebytes fixes it.