Yes, we know 5.x is legacy systems, but since they were extremely stable, we secured them well and held upgrade process, seems will need to little speedup that.
Don't use Winbox v3.11 with v5.x systems.
They aren't properly closing Winbox sessions and when you open users->active session you will get plenty active sessions.
They are garbage sessions: TCP/IP connections was of course already closed.
Problem is: they consume CPU and such junk session is causing memory leak which is leading to Denial-of-Service condition. Bye bye stable 5.x. Thanks to Mikrotik.
That problem was marked already in 2016: viewtopic.php?t=113623 but of course "it will be fixed someday so you can remove junk sessions without reboot".
And no, I have no balls spawning devel login and trying to restart mgmt process on production machine