I've moved your post to the VirusScan Enterprise Community for the team there to comment.
Yes, the feature adds overhead.
But unless you are genreating thousands of IO requests in a short amount of time, you won't really be able to measure that overhead.
If you do see performance overhead, it is likely from having the feature enabled and due to activity of the system.
Like I say, the overhead is minimal for any single operation - but commonly, applications perform thousands, even tens of thousands of operations in a short space of time. Sometimes it's legitimate application behavior, sometimes it's poor programming practice, but whatever the case it's in those situations that AP overhead becomes noticeable.