Your firewall configuration is quite problematic, to say the least. For example, there is no rule established,related in any of the chains, which means that the rulebase is pretty much reevaluated every time. This may be one of the sources of your bandwidth issues. Any indication why you did it that way?
Something else that is missing is the interface list section, while it is not mandatory, this is a good way to group interfaces in a logical way.
To fix this, I recommend to proceed by increment so if there is an issue, backtracking will be easy or at least easier.
First, can you create a few interface lists and populate them with what you have? This allows to use the interface-list in rules.
For example, the interfaces pppoe-out1 and pppoe-out2 are likely WAN links.
/interface list
add comment=defconf name=WAN
/interface list member
add interface=pppoe-out1 list=WAN
add interface=pppoe-out2 list=WAN
Second, let’s re-add the implicit rules for the chain=input (the communications back to the firewall). You will have to move them up to the top of the rulebase.
/ip/firewall/filter
add action=accept chain=input comment="Implicit - Permit established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="Implicit - Drop invalid" connection-state=invalid
Now still on the topic of the input chain: you have at least winbox and the www services enabled but not limited to some IP ranges, and there is no rules in the firewall. This means that your device is open. It would be better to limit the access to just the network where you have the IT personnel.
Do you have a schematic of your network I could use when I redo your rules?