i use 2.9.27 version and i am recentrly facing some issues.
i see cpu 100% and when i run torch, one of my wan interfaces shows too many connections from 2 specific ips and different ports to local 53 port.

After i drop input of those 2 ips, in torch i see the same behaviour.
I have disabled remote dns requests but not fixed.

here is a screenshot of torch.

I think torch shows the packets because the are send to you.
It is regardless of what the firewall does with the received packages.
I assume you are being used as an DNS relay.
Post your ip firewall filter output so we can assist you in blocking unwanted traffic

there is no reason to use such an old version. Update to newer.

I think torch shows the packets because the are send to you.
It is regardless of what the firewall does with the received packages.
I assume you are being used as an DNS relay.
Post your ip firewall filter output so we can assist you in blocking unwanted traffic

Here is ip firewall filter output.

had a similar experience
seemed some sort of a dos
just block the two ip's and you should be fine.

had a similar experience
seemed some sort of a dos
just block the two ip's and you should be fine.

It's odd but i i drop those ip's but the problem persist. Beside that, every day i have some other ip.attacking.