What should be the MemoryLimit value for *nix UF max? I think usually UF takes max to 5% of the memory for normal input config and processing however customer don't want to be messed up in worst scenario where UF is eating all memory.
There is no native limiting parameter - https://community.splunk.com/t5/Getting-Data-In/Limiting-RAM-CPU-and-Disk-utilization-on-Universal-F...
And make sure there is no issue with the what is happening on the UF, like file monitoring or queues - https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-is-taking-about-30GB-of-Memory-I...
I hope this helps!!!