Thanks Christopher, that stopped the "every ~5 sec. bursts. Unfortunately still none of the drives will sleep. So looking a little deeper, using process explorer, I see the WMI service accessing all of the drives, (every second or so) but every 60 sec looks like a file operation is conducted (open) on the drives.
If I shut down the WMI service, I get a warning that 2 services rely on WMI (ip Helper and some security service) so I shut down those services and problem persists. If I shutdown the WMI service the disk access problem stops.
I have stopped every startup program and the problem persists.
I suppose I can't just leave WMI disabled. , so do you have any advice on finding what program is using the WMI service to access the drives?
PS: From what I've read (for you mostly), the LSI SAS 9207-8i will not allow the drives to sleep by default so I applied the registry hack here. Not sure if it actually works because of the above problem..