[webizen]

Usually it is syn attacks cause the conntrack table full unless you have a very hot site. In your case, it is likely syn attacks since there aren't that many connections go to lsws. enable syncookies (sysctl parameter) to alleviate it.