My guess is that it's because when VCRM is running, it monitors your repository directory and will pick up any files you manually copy in there.
If the machine reboots, it doesn't know if anything got plopped into the repository while it was offline, so it decides that rescanning the whole dang directory makes sense.
Now, we all know that's a poor way of doing it. Why not scan for anything with a recent date-created, or keep track of when you last scanned it and only do the ones with a date-modified since whenever that way.
Because the way it is now, it extracts the contents of each EXE to get the manifest or whatever out of it, and that right there is what takes a majority of the time, I'm pretty sure. If it were just a matter of scanning the directory and ONLY doing that for new or modified files, well heck, it'd be done in a few minutes, tops.
Yeah, it's a pain, and it's made me setup my VCRM to NOT get auto updates, and I only copy in the cp*.exe files that I actually care about, but it's a pain for me because I have to scan the HP download pages and prowl around for updated files to manually copy to the repository. But by keeping the files in there to a minimum, catalog validation "only" takes 30 minutes or so on reboot.