I have using comdo firewall for more than a year and now using CIS.
I have only one problem though.
When approving or denying an application from running via the popup that shows up when CIS detects it, cfp.exe goes 100% cpu for about 3-5 seconds before returning to normal.
Is this practically normal?
That is “normal” behaviour but many people righteously complain about it. When adding or changing a rule CIS will totally rewrite its keys to the registry. The more rules one has the longer it takes. On my system it takes more than 10s. The behaviour is still there in the 3.9 beta.
Until further notice we have to suffer through it I am afraid.
Sorry, until now I can’t confirm this, rules are created without a huge delay or high CPU load although the rule list is already very large. I asked in the beta thread if someone could check if still just all registry keys get rewritten or only the necessary ones but I didn’t receive any answer.
Maybe u can check this 
I deleted a D+ rule and it still takes more than 10s here. What is your hardware? Check my sig for mine. I am on older hardware.
I got an Athlon 64 X2 5400+ (2.8Ghz).
I’ve cut the rule rewriting time on my computer from approx. 18 seconds to 2 seconds by using the approach outlined at https://forums.comodo.com/feedbackcommentsannouncementsnews_cis/an_approach_for_configuring_defense_for_many_fewer_alerts-t36657.0.html.