Where should I start looking? top/htop doesn't give any clues. All I see his heavy amavis activity. All of the sites on this server run PHP in Fast-CGI mode, with SuExec enabled, so, CPU activity attributable to PHP appears as a unique process in top. But, I don't see particularly heavy CPU activity for any particular website.
check the mail contents of one or more of these mails in the deferred queue with the postcat command. Most likely you will see in themail headers which website has inserted them in the mailqueue.