Is this a multi-node environment? In earlier releases of Pega I have seen elasticsearch threads start accumulating when the nodes are unable to communicate with each other over the elasticsearch ports (9300-9400). This SA discusses a similar issue, but the resolution was to disable elasticsearch as the functionality wasn't needed: https://pdn.pega.com/support-articles/500-threads-spawned-pegarules-elastic-search
Thanks Nick... it looks like we missed out on opening up those TCP ports on the Windows Firewall on one of the Pega nodes, since it was added retrospectively (rather than through our build automation scripts). It seems to be much better now!