All software firewalls will use CPU, yes. I have no idea about deplete though - it might only do that if you're transferring at really high speeds like in the order of MB/s to/from hundreds of different hosts at once, otherwise if it does it at low speeds, it's a pretty crap firewall. Only firewall I've ever seen do that though (and hence is crap) is ZoneAlarm. 64 MB sounds excessive for memory usage for a firewall too - mine has over 100 filters in, I'm usually transferring hundreds of k/s normally while I'm here at uni, and my firewall has only peaked at 6 MB memory over the past few days.