Can you enable graphing of system resources (CPU, RAM, disk usage) and watch whether the RAM usage grows over time? Or, for starters, what does /ip firewall connection print count-only show a few hours after the reboot? 5 days after reboot I've got only 1500 connections, so I don't think that it's ...