What version are you running with which config?
What hardware do you use and if you log on disk, how does the I/O look like?
File-store can be quite intensive but if CPU is low it sounds more like an I/O issue (or whatever is in between)
This is a duplicate of Suricata high capture.kernel_drops count. I use the PF_RING zc mode - #9 by Andreas_Herz please don’t open a new topic just to push it.