I have been suffering with really poor performance for a week or so sa-learn processes killing the box and think I have finally figured it out.
The sa-learn processes seemed to be processing deleted mail. I access the mail from my Mac over imap and the mail app uses “Bin” as the mail folder name for deleted mail, I believe dovecot/spamassasin was processing all my deleted mail as Ham !
I updated /etc/dovecot/conf.d/99-local-spamd.conf and added bin to the trash line:
antispam_trash_pattern_ignorecase = bin;trash;Deleted *
This appears to have cured the problem,
Maybe this could be added to the default configuration