I`m fithing with MK from a half year to optimize CCR for DDOS attack but no results.. still the same...
One company from Poland install some linux distribution on CCR and without problem Can filtering attacks about 1,5mln PPS with 80% of CPU . Router OS is horibble .