A big part of the benefits to the throughout preset are optimizations to the memory queue which you aren't using.
This seems to imply the issue is related to the usage of the memory queue which I'd definitely be interested in investigating.
You said that the Filebeat is reading primarily fortinet logs?
I'd love to see if I can reproduce this myself but I sold my home fortinet a year ago... so anything you'd be willing to share (config, sample logs, os platform) on here or over email would be a big help.