I am unable to verify the cause of this
My first thought is you could be taking in more messages than it is designed for. Here is some info on scaling.
How to Improve Your Experience With Log Analyzer and Orion Log Viewer - Newsroom - Log Analyzer - THWACK - SolarWinds Community
Another may be the order the rules are processed. Sometimes throwing out the 'trash' messages at the top of the list helped since the message didn't have to fall through all the rules before being discarded.
If it ends up being message volume and the rules don't fix it you could possibly front end your Orion with a Kiwi server and use that server to filter out the junk messages before they get to Orion. Kiwi also has limitations that you can check out here
How many messages can Kiwi Syslog manage? - Geek Speak - Resources - THWACK - SolarWinds Community
