What i did in my environment for systems where the Splunk forwarder was utilizing high cpu was i went into the server in question and cleared out the old log files or archived them to a different directory that splunk was not monitoring. This took care of high CPU usage for the splunk forwarder.
Hopefully this helps you out
