ClamAV I believe loads all the signatures into memory. different sizes could be different configurations or if they do a large signature update in a database. We have no control over the memory of the ClamAV binaries. Some users users have mentioned adding securite to their clamav, this could be why it's larger as well. I haven't notice the memory usage fluctuating too much after its loaded the signatures.