dllhost and the related rundll32 program are legitimate programs that the OS uses to carry out tasks. For example, then you open your system properties window, dllhost is launched to run the appropriate dlls.
Now, because of the way dllhost and rundll32 work, they allow dll's to be run as applications. Spyware programs often use this process to carry out their tasks because the default windows tool, Task Manager, only shows the host, not the dll(s) they are running.
There are tools that you can use that may help you with determining if the dll being run is malicious or safe.
You can download a tool called Process Explorer
here's the link
http://technet.microsoft.com/en-ca/sysinternals/bb896653.aspx
Then run the program as administrator, set it to show attached dll's and then examine what exactly the dllhost process is running.
Here's an example of what process explorer looks like.
First click on the "View DLLs button on the top. This will display attached DLLs to each process thread.
Then find the dllhost that is using all your processor time.
Click it to select it and mouseover the line, it will give you a popup window like the image. If it doesn't move your mouse away and mouseover the line again.
Under COM class in the popup, it should identify what exactly it is running.
Then you can decide if it's okay or not.
If you do not know what the dll does, google the filename to determine if it is malicious or not.
In the screenshot I posted, the attached dll is idstore.dll and a quick google search indicates this file is safe.