I’ve got a workflow that includes a Carthage step with ‘–verbose’. Watching the build run in Chrome (with follow mode on) it pegs a CPU.
I ran the Chrome Developer Tools time profiler on it and saved the profile, which is meaningless to me since it’s based on obfuscated/minified javascript names. But perhaps it will help you diagnose.