Microsoft has published a workaround for the case that you use EWF and that WinSAT is included in your image and it consumes too much memory.

The article is about the following scenario:

• You develop a Windows Embedded Standard 7 or Windows Embedded Standard 7 Service Pack 1 image for your device.
• You added “Performance Monitoring” package in your answer file using Image Configuration Editor.
• You added “Enhanced Write Filter with HORM” package in your answer file to protect the system (C:) volume.
• You deployed your image without executing “winsat prepop”.
• You enabled EWF for the runtime image.

The complete article including the workaround can be found here.