From time to time you get events in the Event Viewer relating to a SVCHOST process, and that’s it ?
Like this one
So to get a bit more info on that PID 892, you can run this command. To filter the PID 892 and list the details.
tasklist /SVC /FI “PID eq 892”
This will list the services hosted by the PID 892
In case of a red alert you can use the Process Explorer to do a more in depth investigation.
This gives you more information to judge the impact of the Event ID.