You have too much alternation. Take some of that alternation out of the patterns and put it into the filter configuration.
The access logs should be fine. The mailbox, audit, and other similar logs will be where the problem is.
Looking at the mailbox pattern, you have a fixed header, followed by
(various patterns, some optional %{GREEDYDATA:mailbox_message}|%{GREEDYDATA:mailbox_trace})$
That looks expensive to me if it ends up delivering mailbox_trace. You could try changing that to
"^%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_source} %{SYSLOGPROG} %{GREEDYDATA:mailbox_trace}"
Then use a second grok to see if mailbox_trace can be parsed. In fact I might split it into 3, using the first to grab mailbox_timestamp, mailbox_loglevel, mailbox_protocole, and consuming everything inside the square brackets as a lump. That minimizes the amount of text you are feeding to a pattern that contains alternation and optional fields.
Similarly, looking at the zimbra logs. AMAVIS is an alternation of more than a dozen patterns, most of which start with an AMAVIS_THREAD. So for an AMAVIS_RESULT it will parse that AMAVIS_THREAD a dozen times as it fails to match all the other options in the alternation. That is all wasted work. You could use an alternation of STARTUP, REEXEC and a third pattern that is an AMAVIS_THREAD followed by GREEDYDATA, then grok that GREEDYDATA against an array of anchored patterns.