The Steam client is verifying MD5 checksums, decompressing and writing to disk as the download progresses. If it's an update, and it's a delta patch, it's rewriting entire files to apply those patches. And they certainly aren't using lz4 (which was designed for speed above all else) -- it's either bzip2 or lzma now. That's the cause of the CPU spikes. Note that heavy disk I/O increases CPU usage a bit as well -- the system spends more time blocking on I/O and less time idle.
I assure you, lz4 in particular is a speed and space win, even on dog shit hardware. There's a reason it's the default choice for ZFS and btrfs.