Do you have a high volume of logs per day coming in? Another thing you can look at is check the default rules. If you had a version of LEM prior to 5.5 there were a lot of default rules turned on by default. If you see a lot of InternalRuleFired events and they are correlated to defaults that you don't care about, then I would recommend turning them off. I have found in several environments that turning those off lessened the load significantly on the processors and sped up the nDepth searching due to the lessened load.
Thanks,
Chrystal Taylor