The Roundcube (cpanelro) process was using 90% cpu. I watched it for a few minutes and saw that the PID (Process ID) was not changing. So I killed only that one process. Roundcube is not a daemon so killing the one process does not kill roundcube, it only stops the one occurance which is using up all of the resources.
First, I'd like to say how disappointed I am with cPanel developers, who ignore such an important issue. They should have released an emergency fix, instead of waiting for the next version (which takes 3+ months before its available to STABLE).
To the commenter above, the issue is still there, it doesn't happen 100% of the time, a user must first login to Roundcube and some variables must take effect.