Yeah, I've had a similar issue on an Elastic Cloud deployment where the ingest pipelines for Fortigate and Palo Alto were impacting the CPU usage on hot nodes.
In my case the only solution was to offload this to Logstash using the elastic_integration filter, after this both the CPU usage and the delay we had were fixed.
But this requires an Enterprise License.