Hmm, windows defender mentions that it quarantined this

\zpoolminer2\bin\ccminer_polytimos\ccminer

when it popped up originally I told defender to restore it and it's running that miner now. Perhaps the initial estimates were just over inflated and leveled out.