These are the typical issues on my systems with high CPU:
1. Missing indexes 2. Inefficient code 3. Out-of-date statistics 4. Bad execution plan (see #1 and #2) 5. Insufficient memory, causing physical IOs rather than getting them from memory
Regarding sp_who2...run a server-side trace to capture the load and then sort it by Duration DESC and then another query to sort it by Reads DESC. You are likely going to find very high reads. How do I define high reads? Well it depends on the system, but I definitely work on the ones with reads into the hundreds of thousands or millions. When I run a trace, I often will only capture Reads>5000.