Why the hell don’t you limit the CPU usage of that service?

For any service that could hog resources so bad that they can block the entire system the normal thing to do is to limite their max resource usage. This is trivial to do using containers. I do it constantly for leaky software.