One place to dig in is Query Store. Query Store records data about query execution aggregated per execution plan and run-time stats interval. The default interval is one hour.
The view sys.query_store_runtime_stats_interval lists the intervals. Beware of the time zone!
When you have an ID for an interval you want to investigate, you can query sys.query_store_runtime_stats for that id:
SELECT * FROM sys.query_store_runtime_stats WHERE runtime_stats_id = <id>
ORDER BY count_executions * avg_cpu_time DESC
The ORDER BY sorts the plans by total CPU time in the chosen interval.
The plan_id column brings you to sys.query_store_plan which gives you a query_id which takes you to sys.query_store_query. Here you find a query_text_id, which points to sys.query_store_text where you can find the actual query text.