nsd process was high at 100% and cpu at 75%. The messages logs were populated with DNS resolve error and console populating scheduler oinker messages

high NSD process

> show system processes extensive | match nsd

high RE cpu

> show chassis routing-engine

Log messages filled with DNS resolve error

> show log messages | match resolve

Scheduler oinker messages on console regarding NSD PFE process

This could be due to the nsd being busy due to excessive resolve failures on DNS for the addresses configured in the address book entry

Two possible workarounds:

1, resolve only IPv4 addresses if IPv6 address is not needed
set groups ipv4-only security address-book global address <*> dns-name <*> ipv4-only
set apply-groups ipv4-only

2, split large address-sets with dns-names and applied to new added policies.