Steal time is time the kernel can't account for as user, system or idle. In a virtual environment, if you have some cpu bandwidth limiter, the kernel will see work being done outside its purview - effectively the hypervisor 'steals' it back. This becomes the %st. I've seen it in heavily...