I continually have a large number of ArcSOC.exe's running on my Windows Server 2012 R2. See the images below.
I do have multiple services with a high number of allowed instances but even if there are 0 users consuming the service it seems like these ArcSOC.exe processes are still running.
I also wrote a script to restart the entire ArcGIS Server Service Every Night (when no users are active) to remove any hanging processes.... but all day these process remain. Is this normal behavior?
If the minimum number of instances on your services is set to '1', there will be a minimum of one ArcSOC.exe instance running per started service. You'll also add at least one for each started service in the 'System' folder. For services that aren't used often, you can set the min number of instances to '0', but keep in mind that it will take clients a bit longer to use the service as an instance spins up. The command line column should help understand which service each SOC instance is tied to.
How many services do you have published?