The check the system uses is the normal “hr_cpu” check. That means that the outside world don’t know what OID is witch CPU. For CMK it looks like a two core CPU.
Inside the rule “CPU utilization for simple devices” there is an option “Levels on single cores”. I think this is the only option you can use for alarms on one of the two cores.
It would be nice to know if the Palo Alto provides better or more data over it’s REST API.