Instead of enumerating PercentProcessorTime
for particular PIDs try enumerating processes that exceed the threshold and terminate them if their name matches the criteria:
Set wmi = GetObject("winmgmts://./root/cimv2")
perfQuery = "SELECT * FROM Win32_PerfFormattedData_PerfProc_Process " & _
"WHERE PercentProcessorTime >= 20"
For Each p In wmi.ExecQuery(perfQuery)
pidQuery = "SELECT * FROM Win32_Process WHERE ProcessId = " & p.IDProcess
For Each p1 In wmi.ExecQuery(pidQuery)
If p1.Name = "rundll32.exe" Then p1.Terminate
Next
Next