What is com.apple.MobileSoftwareUpdate.UpdateBrainService doing?

This is a legitimate component of macOS that runs before software updates are installed.

Specifically it validates the software that gets downloaded and sets up the conditions for the secure boot architecture to be enforced.

If you can not have it running and choose to relax startup security, you can avoid this personalization check and bypass validation at every boot that Apple software updates are not only correct from Apple but personalized for the specific Mac on which it's about to be installed.

... when the Full Security policy is in effect, a given signature isn’t just signed by Apple but is signed for this specific Mac, essentially tying that version of macOS to that Mac. This helps prevent rollback attacks as described for Full Security on a Mac with Apple silicon.

As often is the case, Howard Oakley has written extensively and clearly about this new software on his blog at The Eclectic Light Company:

... the update takes three phases: download, preparation, and installation. The second of those, run by the Update Brain Service com.apple.MobileSoftwareUpdate.UpdateBrainService, assembles all the components required, verifies them, decompresses data and readies it for the final phase.

In your case, you should expect this to run every time an update is considered unless you relax the security of your startup settings. If you need to stop the CPU usage temporarily, disconnect from wifi, restart and then this check should pause and allow you to change the security or get done what you need before you let this process validate a pending software update is correct.