using the factory package on my 11.2 server.
config:
[[[
> grep -vE '^(#.*|\s*)$' /etc/rsyslog.conf
$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so   # kernel logging (may be also provided by /sbin/klogd)
$IncludeConfig /var/run/rsyslog/additional-log-sockets.conf
$IncludeConfig /etc/rsyslog.d/*.conf
kern.warning;*.err;authpriv.none         /dev/tty10;RSYSLOG_TraditionalFileFormat
kern.warning;*.err;authpriv.none        |/dev/xconsole;RSYSLOG_TraditionalFileFormat
*.emerg                                  *
if      ($syslogfacility-text == 'kern') and \
        ($msg contains 'IN=' and $msg contains 'OUT=') then \
        -/var/log/firewall;RSYSLOG_TraditionalFileFormat
if      ($syslogfacility-text == 'kern') and \
        ($msg contains 'IN=' and $msg contains 'OUT=') then \
        ~
if      ($programname == 'acpid' or $syslogtag == '[acpid]:') and \
        ($syslogseverity <= 5) then \
        -/var/log/acpid;RSYSLOG_TraditionalFileFormat
if      ($programname == 'acpid' or $syslogtag == '[acpid]:') then \
        ~
if      ($programname == 'NetworkManager') or \
        ($programname startswith 'nm-') then \
        -/var/log/NetworkManager;RSYSLOG_TraditionalFileFormat
if      ($programname == 'NetworkManager') or \
        ($programname startswith 'nm-') then \
        ~
mail.*                                  -/var/log/mail;RSYSLOG_TraditionalFileFormat
mail.info                               -/var/log/mail.info;RSYSLOG_TraditionalFileFormat
mail.warning                            -/var/log/mail.warn;RSYSLOG_TraditionalFileFormat
mail.err                                 /var/log/mail.err;RSYSLOG_TraditionalFileFormat
news.crit                               -/var/log/news/news.crit;RSYSLOG_TraditionalFileFormat
news.err                                -/var/log/news/news.err;RSYSLOG_TraditionalFileFormat
news.notice                             -/var/log/news/news.notice;RSYSLOG_TraditionalFileFormat
*.=warning;*.=err                       -/var/log/warn;RSYSLOG_TraditionalFileFormat
*.crit                                   /var/log/warn;RSYSLOG_TraditionalFileFormat
*.*;mail.none;news.none                 -/var/log/messages;RSYSLOG_TraditionalFileFormat
local0,local1.*                         -/var/log/localmessages;RSYSLOG_TraditionalFileFormat
local2,local3.*                         -/var/log/localmessages;RSYSLOG_TraditionalFileFormat
local4,local5.*                         -/var/log/localmessages;RSYSLOG_TraditionalFileFormat
local6,local7.*                         -/var/log/localmessages;RSYSLOG_TraditionalFileFormat
]]]

after running for a few minutes it starts using 100% cpu. if you strace it you see it trying to write to the /dev/xconsole FD, but it fails with EAGAIN. removing the line for the xconsole fixes it.

this didnt happen with the 11.2 version of rsyslog.

Marius found out it happens after about 500 message/128k data.