Here's a direct quote from MS....
"Svchost.exe is a generic host process name for services that are run from dynamic-link libraries (DLLs). The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load.
There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging."
Mine is for sure clean and I have 5 svchost instances atm.
There were/are a couple welchia variants that tried to register and run as svchost, but your software would have caught that.
If you get a chance, trend micro has a pretty decent online scanner that I use sometimes to double check my SAV
trend