CPU Issue when enabling RPKI

That is incorrect. If you don’t correctly use the Linux DSA bridge+VLAN filtering, you’re breaking offloading. Read this:
http://forum.mikrotik.com/t/mdns-repeater-feature/148334/322

https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration

CCR2004 configuration will be the “Other devices with a built-in switch chip” in the basic VLAN switching documentation, based on the switch chip model.