Maximum number of subscribers per FPC in Juniper MX

Question

If link with subscribers, containing about 12000 clients, goes down. One aggregated ethernet containing two links which goes to two different FPC's. All clients try to authorize on JuniperMX with the help of DHCP Discover messages. This is eoip network.

In case of authorizing too many clients (with the help of RADIUS), FPC (MPC 3D 16x 10GE) CPU goes about 100% and stops processing other clients authorizations.

Is this normal and I should limit clients per FPC or I have some misconfigurations?

juniper-1> show version 
Model: mx960
Junos: 16.1R6-S3.1
JUNOS OS Kernel 64-bit  [20180310.ba55661_builder_stable_10]
...

And licences are used less than exists in the system:

juniper-1> show system license     
License usage: 
                          Licenses     Licenses    Licenses
  Feature name                used    installed      needed 
  ...
  scale-subscriber           39614       128000           0
  ...

All four LAG's has identical configuration and composed from 2 10G links. Every link connected to different card (xe-0/2/3, xe-1/0/1):

juniper-1> show configuration interfaces ae3
flexible-vlan-tagging;
auto-configure {
    vlan-ranges {
        dynamic-profile vlan-autosense-profile {
            accept dhcp-v4;
            ranges {
                3-4094;
            }
        }
    }
}
encapsulation flexible-ethernet-services;
aggregated-ether-options {
    load-balance {
        no-adaptive;
    }
    minimum-links 1;
    link-speed 10g;
    lacp {
        active;
        periodic fast;
    }
}

Allowed vlans are configured from downstream switch. Every vlan allowed only once on one of four links. I.e. VLAN100 allowed on ae1 only.

juniper-1> show configuration dynamic-profiles dhcp-local-server-profile 
interfaces {
    demux0 {
        unit "$junos-interface-unit" {
            no-traps;
            proxy-arp;
            demux-options {
                underlying-interface "$junos-underlying-interface";
            }
            targeted-distribution;
            family inet {
                demux-source {
                    $junos-subscriber-ip-address;
                }
                inactive: filter {
                    input "$junos-input-filter";
                    output "$junos-output-filter";
                }
                unnumbered-address lo0.0;
            }
        }
    }
}

Every client has from three to five activated services. Autosence profile configuration:

juniper-1> show configuration dynamic-profiles vlan-autosense-profile   
interfaces {
    "$junos-interface-ifd-name" {
        unit "$junos-interface-unit" {
            demux-source inet;
            proxy-arp;
            vlan-id "$junos-vlan-id";
            family inet {
                unnumbered-address lo0.0;
            }
        }
    }
}

juniper-1> show configuration system configuration-database    
max-db-size 314572800;

Allowed users with public IP's has four services (speed limits - local networks, global networks, state networks). If client has private IP it has additional service - "redirect gateway to NAT server". Finally all clients which has denied network access has service for "denying".