AES decrypts and Recrypt transforms were both happening in the decrypt future after the network DocumentGet for metadata comes back. This meant that the future was doing a big chunk of CPU heavy crypto work without yielding or doing anything special to accommodate it. We should have a PR soon that uses tokio::spawn_blocking to explicitly move that section of the future onto a threadpool for heavy stuff, allowing the normal threadpool to keep cranking on the network work. This immediately improved CPU utilization.
Description in https://github.com/ironcorelabs/ironoxide/issues/241#issuecomment-883502432 by @skeet70: