Event 5000 is generated when the scanner comes online.
This means it's reading many megabytes of data into memory (~140mb), then flushing a large portion of that data back to disk (creating a ~90mb memory mapped file).
This is a resource intensive operation.
Apps that are sensitive to "heartbeat" probes are quite likely to think their heartbeat has stopped.
If your VPN or other network access control solution uses a heartbeat, this is likely the issue. The resolution would be to lighten up the heartbeat check - though there are some thread priority tweaks you can look into in our knowledgebase.
I tried to find some tweaks in the knowledgebase, and I didn't find, can you please help me with those thread?
KB68965 and KB66044 discuss tweaks with regards to thread priority for the various processes involved in an update, namely the framework service. Another thing that can be tried is to schedule the update out of hours. Depends on your current setup, how the connection is re - created etc. I have used "thread priority" as keywords for the KB, there may be more articles to be found.