[rw-]

Consider using ipset. Your ruleset is very huge and slows down your netfilter...

[jawn]

Thank you so much for the tip, I'll look at doing this.

FWIW though I have almost no traffic to these boxes, so I've never noticed any sort of performance issues.