[LG Optimus 4X HD] Izzysoft:
Already suspected something Xposed related, in fact. The lagginess started about the time shortly after (not immediately) I've added the last module there. But that link also says I'd better have used Magisk, which you said I should not :p

Confirmed, it does. But there are some other modules I currently need. For example, YalpStore isn't able to write to the SD card, so I'm using a module to permit that per app ("Marshmallow SD fix"; that was the "last module" mentioned above. And funny: While I write this post and have to lookup details on the device, it's running pretty smooth. Well, I had to reboot it this morning as the delay got too long and I was uable to unlock the screen because of that).

Close, but no cigar. Can it fake DeviceIDs, location data, empty contacts/calendars, "unavailable network", etc? Does it allow for "on demand" requests, and keep per-app access logs (oh, not detailed but "last access" at least can be found in the "advanced section")? What are the things XPrivacy covers but SafetyGuard doesn't?

Btw: Thanks for the long-press hint, hadn't discovered that yet. Will investigate.

I've not touched PG. And besides, my other device runs CyanogenOS 13 with almost the same setup (Xposed, XPrivacy – only via Magisk there), and has no such issues at all. If that's the culprit, wouldn't it be possible disabling PG in favor of XPrivacy? But honestly speaking: XPrivacy is the main reason keeping me from Nougat. If I can reach the same level with e.g. PG (even if that would mean adding AFWall for the Internet part), I'd be looking if I cannot go that path. A few of the modules installed I could probably do without (Amplify, DynamicAlarmIcon – which isn't even yet activated). Others will cause me some headache when missing ("Backup All Apps" to enable "adb backup" to really do that, even if some devs had their app "opted out"; GravityBox for some added customization). The really big "jump into cold water" will be the lack of XPrivacy, though.

EDIT: After a quick "walk-through" with explanations (YT video; it was quite a while ago I last had a look at this) my impression is it's not that flexible as XPrivacy – but for that much simpler to use. Answering my above questions myself, partly at least: it allows on-demand requests and can deal with network as well (even differentiating by WiFi and mobile data), also differentiates between reading and writing things (e.g. contacts). Will need to dig a little deeper, but I'm getting positive about that. Apart from which: if the phone is that safe that I can't even turn it on anymore, that's not very helpful anyway ;)

Sure – but thanks for mentioning it! One too easily forgets.

I doubt Tasker is causing overload here. It never did on previous ROMs, and I have no heavy profiles set up.

I was searching for the governor settings but couldn't find the related menu. Was I too blind, or does that need a separate app (like Kernel Adiutor, which is mentioned in the first post of this thread)? I'd prefer not to add more Playstore dependencies (but rather get rid of those few I still have) – especially none requiring "validation" to work (here: Recently to enable it automatically on boot would require the paid version).

I'm very sceptic reading the name "Ghostery", even if it claims "no ads/analytics". AFAIR that service doesn't run "plain local" but calls home for the one or other reason ("to improve UX", certainly ;)) I'd rather let AFWall and AdAway care for what can be called.

Sounds interesting. But as LibRadar is written in Python and uses a not-that-small database, that might end up being a monster. PM me on details if you wish, and primokorn is welcome as well of course.

Need a screenshot? See this post on Stack Overflow, which also shows the "normal numbers" (0.xx, first line of the overlay; mine currently shows 1.09/2.14/3.88, just idly lying on the table).

[IMG="CPU Usage Data Overlay"]https://i.stack.imgur.com/oU32V.png[/IMG]

I've left mine on while connected to the charger last night, with the device "daydreaming". Load NEVER went below 3. and sometimes peaked up to above 7.x – which is very abnormal for a "device at rest". Processes quite often at top of the list (ie. those causing the most load) included: system_server, systemUI, surface flinger (while at rest and display not touched!), ksmd. Hm, funny, the first 3 candidates also show on the SO screenshot, so them being on top seems to be not unusual.

That will be hard as I'll be losing quite some functionality – and will always be worried about privacy leaks (especially from the few remaining Playstore apps). I will see what's possible (or has other replacements) – especially because I agree Xposed looks very likely to be involved here.

So that's then to be flashed on-top ("dirty flash") – or would require the entire setup to be redone ("clean flash")?