Sounds like the path through the disk subsystem is altered when the AV software is installed on the system. The only thing that changes is the action the AV software takes, not to alter the links in the chain, when the real time shield is disabled. Used to see that with filter drivers for AV products, but didn’t realize that still happens with the API’s that Microsoft provides these days.

You didn’t mention - what OS and is it a network location or a local disk?

Have you tried MSE to see if the same performance impact occurs with any AV package registered to the API?