As far as I remember the default mode for the main message queue in rsyslog is fixed size array. It has a limit for 10k elements or so. Try to change this to linked list queue it should handle your occasional message bursts much better.
Yes, there are FixedArray
and LinkedList
queues.