I confess that our customer is very concerned about PCI-DSS compliance, so all I had to do was to ask myself what I thought that the auditor would want to see.  ;-)

That, and the fact that these machines are not dedicated to the purpose of doing anti-virus scanning, so we don't want that function to be able to completely wipe out their ability to do anything else, by perhaps tying up ten threads and keeping the load average pegged at 8.0-10.0 for minutes or hours at a time.

That pretty much completely explains all the defaults that I changed.