Some questions on the performance of Zeek(with pf_ring ZC)

Hi, everyone
we have a problem with the performance of zeek.

We have tested Zeek’s performance in lab environment with a traffic generator, it seems that Zeek’s performance is not good as we expected.

The zeek sensor is installed in a server with 16 cores (32vCPU) -2.2Ghz, 128G RAM.
The traffic generator makes the http traffic with a 4KB size webpage.
The zeek sensor used 30 worker(each worker pinned to a vCPU), and we also implemented pf_ring ZC to accelerate it.
And the zeek version is native v4.2.

When the traffic arrives 14,000connection/s (the traffic is less than 1Gbps),all the CPU usage reached about 80% or more. It seems that a single zeek worker can only process less than 500 new connections per second.

And we also tested in 1 zeek worker to verify it, and found that its peak process was actually about 500 connection/s (1 zeek worker with a vCPU).

We don’t know if there are anything wrong in our test seniors. But compared with suricata, zeek’s performance is very low. We also set a suricata sensor in the same server, and suricata can process over 60,000 connection/s with 20000 signatures

And we make much efforts to improve it, but it doesn’t work. Is there any methods to improve it ?

Thanks a lot.