If some NSS offload is active, that would effortlessly explain the lack of control sqm seems to have over the capacity limits.
I do seem to recall that someone on this forum made scripts to offload some of sqm's functionality to NSS cores, no idea though whether this would work on your router...
see here: