I agree with Phillip that v6 is probably not the source of your CPU load.
Note that since all of your wired client devices (windows,linux,OS-X,AIX,...) are dual stack, your network monitoring should be dual stack v4 and v6, and even on vlan's which only route v4, should protect against mixed protocol MITM attacks by preventing clients from sending ICMPv6 RA's or DHCPv6 replies, similarly to preventing DHCP (v4) replies already. Some of that can be done with ACL's on the switchports.
At the University of Wisconsin-Madison we've been using switch configurations since 1999 (!) similar to this:
interface GigabitEthernet1/0/3
switchport mode access
switchport port-security
ip access-group v4client in
ipv6 traffic-filter v6client in
...
ip access-list extended v4client
deny udp any eq bootps any eq bootpc
deny icmp any any redirect
permit ip any any
ipv6 access-list v6client
deny udp any eq 547 any eq 546
deny icmp any any router-advertisement
deny icmp any any redirect
permit ipv6 any any
In terms of blocking v6, native or tunneled, you can block ethertype 0x86dd to block native v6 packets. You'd probably also want your firewalls to block protocol 41 (IPv6 payload in an IPv4 envelope) and the default teredo server port 3544/udp. That will take out the main 3 automatic tunneling protocols for ISATAP, 6to4, and Teredo.
