The icon only spins when it is scanning (that is what on-access scanners do), so what you have to check is what is it scanning, so there is something going on on your system.
What are you doing when this happens ?
You could enable this option, 'Show detailed info on performed actions,' it will show what files are being scanned by the on-access scanner (Standard Shield), it may be quick but it should give you an idea of what is being scanned and hopefully why. If you can give some examples of the file and locations that are being scanned ?
This function is also on the Web Shield and Internet Mail providers so you should also check those, if thee isn't much shown on the other one.