I have a 3km link, 5Ghz.Tx/Rx is 77/66; this should be enough for a stable link

For some reason I have randomly huge delays in ping.
Usually I get 2 ping around 5 ms and then a few around 500ms
I am using version 6.40.1
CPU is about 30% without any special routing features

Any idea what it might cause the problem?

Doesn't look so stable.

Which devices are you using? Is this a PTP or a PtMP? What's the System > RouterBoard Current vs Upgrade Firmware on both?

If this is a PTP, for 3km link, signal levels are really unleveled, assuming both AP and station are the same model, I'd bet you have either fresnel or local interference issues.

You have two options: either fix this so that signal levels are optimized, or lock down the datarates on the AP to the maximum, but stable latency one (assuming AP is on the Internet side).

Regarding high CPU, could be your setup. No need for firewall nor anything on a PTP, see this post as an example of optimal performance PTP config.

BW test also shows problems with the link...
BR433 on my side with cm9 cards

Firmware seems updated:
There are no obstacles in the path.

BR433 on my side with cm9 cards

Cards? There's more than one? What's at the other side? A sector (PtMP)?

I have 3 links, all 5 ghz, all with cm9 cards.
All link have a dish plus a 5ghz feeder
I dont have firewall, and 30% CPU isnt too high I think

rates are already locked: I will upgrade to 6.40.2

Signal is too low. It will never work as it should. You have a problem if for 3km and dish signal is -77.
Also a stable link should have at least -65. -50 to -60 recomended for full speed also.

After doing some changes link is now constantly -66/-66 both ways and RTD is more constant However, I see huge difference in badwidth test:

Sent traffic reach 27 Mbits, receive constant to 1mbit with some 15 mbit peaks: this shows on which side of the link is a problem?

That looks much better.

I have 3 links, all 5 ghz, all with cm9 cards.

On the same RB433? There's where your problem probably comes. Specially if at any given moment two of them need to Tx and Rx simultaneously.

I'd rather seperate radios on different RBs, and go straight to integrated units (SXTs, LHG, DISC...) if that would mean purchasing them. Ten years ago a setup like that (RB433 with CM9's) could make sense, nowadays with N and AC speeds, and given the cost of integrated units, just doesn't.

rates are already locked:

Those are your Tx rates, your problem is on Rx, so the rates you would have to lock are those on the AP. That's why I asked if it was a sector or a PTP; if it's a sector and you lock down rates, you'll be locking down rates for all stations, highly doubt your WISP would agree on that.

I am not using N or AC technology; these are two 802.11a and one 802.11b links with low speed requirements.
(On a previous post I incorrectly posted that all are 5ghz)
Yes, indeed this is an old setup (5 years old or more) where these technologies were not available.

All links are point-to-point links (ap-bridge and station); without multiple clients.
WISP? Its four homes having three links.

The problem isn't bandwdith limitation. It's link quality.
The traffic never go above 2 mbit one each link. Moreover, even if I disable the other links, high RTD still appears.

Ok, then if those are PTPs, lock down the highest stable, low RTT datarate on the AP radio.

Be sure to pass traffic while evaluating highest stable datarate with low RTT. If RTT goes nuts on a given datarate, select the next lower one.