Right now all packets between VLANs (and access ports towards your CHR) are passing CRS’ weak CPU.
You should reconfigure CRS to use single bridge and vlan-filtering … you can have a look at this fine tutorial.
Your CRS3xx will then deal with VLANs in hardware (switch chip).