Pathauto is not a "light" module and does have performance implications for your site.

6.x-1.x versions

The Token API for Drupal 6 generates all possible token values, whether the tokens will be used or not. For sites with a large amount of modules that provide tokens, or have "expensive" tokens like node bodies, CCK fields, etc, generating tokens for an object is very expensive.

For each token that is generated, Pathauto has to run it through the pathauto_cleanstring() function to 'Pathauto-ize' it (i.e. change "Sample text" to "sample-text").

6.x-2.x versions

Most of the same concerns apply as the 6.x-1.x version.

7.x-1.x versions

The Token API in Drupal 7 core uses on-demand token generation and will only generate the token values that are requested, rather than all possible values. This in itself is a major improvement. Other pain points like pathauto_cleanstring() are cached as best as possible.