Do you have an interface assigned in the Intrusion Detection settings which is a VLAN-interface?They don't work well and increase firewall load by a lot - thus decreasing throughput performance.Keep in mind that tweaking ID-settings with a VLAN interface might crash the firweall.
Can you try to load the list via URL table in Firewall rulesets and do it as a rule?