I would suggest doing some reading on Bro clustering going a little deeper on your ‘lb’ configuration.
Not knowing what the data/packet rates you are attempting to process but in my experience asking a single process thread to do more than 300 Mb is going to ensure you get packet drops.
Below is part of my node.cfg for a 500Mb complex network data test lab setup I am currently running hosted in Centos KVM so I can learn/test some of the DNS/SSL scripting features.
[worker-1]
type=worker
host=localhost
#Interface=dag0
lb_procs=4
lb_method=interfaces
lb_interfaces=dag0,dag1,dag2,dag3
pin_cpus=4,5,6,7
Hope this helps you.
Regards
Robert Cotter