Frosty piss y'all...

I don't think you should be finding much aluminium in your piss.

Windows is a hybrid kernel. Linux puts a lot more into kernel mode/real mode than Windows does.

Oh come on now, "hybrid" kernel is nonsense marketspeak; all the high-level services such as networking and filesystems and drivers run in the same address space. How they chat to each other is irrelevant here, NT is a monolithic kernel. And what the hell is a configuration database, the Registry, doing as a kernel service? And then there's GDI etc. --- (up until recently used to be) a kernel service.

The only thing I can think of that runs in kernel mode in Windows and not in Linux is the graphics system

The thinnest end of the graphics wedge (namely, modesetting, GPU multiplexing and memory management) is now being pushed into the Linux kernel, where such low-level hardware stuff should be. The GL heavy lifting and provision of a high-level graphical system (e.g. windowing, viz. X) is done in userspace, where it should be. The problem with Windows used to be that a lot of the latter was also a kernel service. Flickering displays are quickly becoming a thing of the past these days as typically the optimal resolution is chosen early on when the relevant DRI module (i915 or radeon, so far) loads.

I don't use Microsoft products, but am I missing something here? What is .pst used for exactly?

Dunno. Think it's something the "need-a-machine-to-run-my-life" types use.

Evil maids are easy to spot because of their goatees.

Whoa, what kind of room service are you getting?!

• ACPI embedded controller, a separate microprocessor in the chipset that runs its own firmware (typically packaged alongside the BIOS) that monitors the temperature and controls fans in manner orthogonal to the goings-on of the rest of the system.
• System-management mode where, upon detecting some thermal condition, the chipset puts the CPU into a special operating mode that executes a particular piece of BIOS code presumably to emulate the above. In this case, SMM BIOS code is executed. This happens without the knowledge or control of the operating system.
• Protected-mode ACPI control whereby the OS kernel runs the ACPI tables (read from the BIOS on boot) on a virtual machine. These tables include some bytecode to activate the fan once a trip-point is reached. x86 binary found in the BIOS is not invoked here.

The first is clearly the most desirable, as SMM is just plain wrong, and hardware protection should not rely upon the stability of the operating system.

What's happening in your case could be a problem with the EC somehow becoming confused, which is likely either a BIOS or EC firmware bug.