1GB/s in DNS is quite some data. How big is the pcap? Did you replay with '-t'? We parse the message + generate JSON-text from messages (requires some more memory than original DNS message). Wonder if indexing in elasticsearch generates some back pressure here, forcing internal queue/buffers to fill up. See this github ticket.
Have you tried to reduce the transaction timeout? E.g. for testing set to 1 second.