try pstree firstofall to see where it launched from,
then lsof -p <pid of gzip> to see what files it's working on,
then, if you need to watch real close you can even trace it using strace -e write,append -p <pid of gzip>
But normally lsof is the best bet, investigate the open files and you'll find out everything.
Check out my SSD guides for Samsung, HGST (Hitachi Global Storage) and Intel!
A customer could simply be using the cPanel backup feature. If it is the cPanel backup running, it will gzip content. Also the gzip process will use more CPU and take longer if the user has Gigabytes of content.