I happened to be stepping through the pass execution and noticed that the GC intrinsics lowering was still scanning the IR in LowerIntrinsics::PerformDefaultLowering. We don't need this in LLILC with the CoreCLR strategy and we should avoid it and save a bit of TP.
Looks like we need to set CustomReadBarriers and CustomWriteBarriers true or something similar for the Strategy to prevent this.
However, there's a comment in GCStrategy.h that puzzles me -- it says if the strategy specifies UseStatepoints (which we do for CoreCLR strategy) then all the other options should be defaults. Presumably it meant to say that using gc.root and related does not make sense as roots are not explicitly identified this way with statepoints. What happens for read/write barriers would appear to be an orthogonal issue.