Solution
Do: echo "16384" > /sys/block/sda/queue/nr_requests
Setting 'timeout' and 'toolong' both to 600 causes FlowTraq to divide long-running sessions into smaller ones, and the system performs smoothly. No more choppy inflow, and AVGTIME down to 300ms.
NOTE: If 'toolong' is set short, queries of the TTIME/Flow Duration type no longer work (one can't look for a 2-hour session if it was chopped up after 10 minutes)
CAUTION: changing ‘timeout’ and ‘toolong’ can reduce the accuracy of the Exfiltration detector.