Unfortunately I've still not found the reason for the 20k/s limit. My solution for the moment is that I run multiple filebeat instances on the same machine via docker. Currently I'm at 4 docker containers running filebeat with netflow input. They are able to collect at least 80k/s which should be sufficient for us for the moment.
As this is only a workaround, I would still appreciate hints of how it could be possible to achive higher throughput with just a single instance.