100% sure this user failed to properly configure L3 offloading, single bridge config approach with VLAN segregation. So traffic is going via control plane instead of the data plane (ASIC).
http://forum.mikrotik.com/t/ccr2116-disappointing-cant-do-2gbps-pppoe-single-cpu-95/170531/4
@normis if you read this, I think it’s high-time MikroTik abstracts the config away across all legacy and new hardware to ensure users don’t face L3 offloading/fast-path misconfigurations. Similar to how we work on JunOS for example, I don’t need to think “single bridge + this + that” to make sure things are offloaded correctly.