Well, I was trying to say that
- a single file is scanned using one core
- on-demand scan is a (serialized) sequence of single-file scans
Regarding the CPU utilization - yes, as I said, the usual bottleneck is the hard disk; CPU usually waits for the data.