MacOS Activity Monitor gives you a list of all the apps you run, which is useful for closing CPU-hungry processes. But it also throws in a lot of system process, some of which may not be safe to quit. Here's how to tell the difference.
Who are all these users?
First, you should look at who owns the process. Processes in macOS (and any other Unix-like operating system, including Linux) have owners linking each process to the user account that started the process. And while you will recognize your user account, there are many other users on the computer, most of whom are managed by the system.
You can see here, on a standard installation of macOS, over 250 users are managed by the system, most starting with an underscore:
Macs have so many user accounts due to how the permissions work in macOS, and each user has specific permissions. For example, _Dock would have permission to access files related to the dock and not much else. This keeps your system safer by keeping low-level systems in their own containers.
Important: Since most of these are pure system processes, it is best to never stop any process whose owner begins with an underline.
It is probably safe to close all processes under your user account name because most will automatically start if they are needed. However, you should not go crazy when you close everything to save system performance, as most of the processes running on your machine are vacant. It is much better to leave them there when needed, instead of spending extra resources opening them again.
Processes with an icon next to their name denote apps that are usually safe to close. You can sort by "% CPU" to display the apps that use the most resources:
Some of these, like Google Chrome, will have help processes used to improve performance. You will want to quit apps like Chrome from the Force Quit (Option-Command-Escape) menu instead of Activity Monitor.
One thing to note is that if the app has any of the two icons below you should be careful when closing it:
The icons to take care of are a white sheet with a pen, brush and ruler in the form of an "A" or a shield.
The first is the default icon for an app without one, which may mean that it is a background process that does not need an icon for user use. The latter is an icon specific to user-level Apple processes, such as Siri, Finder and Dock.
What is "root"?
Next up is root, which is the user account with most system permissions. This is a weirder, because most of the root account process system handles, but some things you start will be started as root-specific things that need to access the system resources at a low level. These are harder to detect, because you need to know what you're looking for:
Here's an example: ckb-next is a third party driver for my Corsair USB mouse, so I know that ckb-next-daemon, which runs as root, is a help process for that app. If I were to close it, the mouse would stop working. If you see something that you recognize as root, it may be safe to shut down, but most processes in this category are systems that you should not touch.
Under the View menu in the top menu bar, you can change which processes will be displayed. You can choose to only show processes that have Windows, which will display the same list as the Force Quit menu. You can also see processes started by you, the system and those who are active or have been inactive.
The useful part of these filter views is that you can sort by "% CPU" on top. For example, you can see the processes that are the longest running by selecting "System Processes" as filters and "CPU Time" as sort.
Whatever you choose, do not choose to really harm your Mac, whatever the damage you can do can be solved with a simple restart. The best way to clear the process list is to restart the computer, which will clear away unnecessary things. Look for apps that start running just as you log in and uninstall those you don't need.