Not sure if you've seen the FW4 / NFTables tricks and trips threads, but the nft monitor in conjunction with the nftrace function looks really useful. Given how odd your problem is, I'm not sure if it's going to help or not, but it'll certainly tell you where the traffic is going from an nft perspective.
qca-nss-drv pushes interputs for nss_queue1 over to CPU1 in my case, but what's confusing me is why I have nss_queue1 listed twice in /proc/interrupts. The script itself looks pretty generic and therefore able to handle devices with more CPUs and queues than we have, like the ax3600, which also has it's nss_queues listed twice in interrupts, so I guess there's a good reason for it...