Check the documentation for the "mode" setting in the inputs.conf, in the past changing to "online" mode helped a bit.
Also check the no-resolve as this takes up the cycles, you don't want to resolve the objects.
https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup2
It also depends on the number of checkpoint managers/connections you are handling on one forwarder. When it gets to millions of events from 50 different connections on forwarder can really get overloaded and you might need to look into distributing the load.
This is just one of the scenario I have seen, but the yours might be different.
... View more