Resolved! Too many active services.
I have a website with very high hit rate which is protected by IPS. There've been complains about some dropped request so I've gone through IPS Event Viewer and I found many of this:evError: eventId=1321353761353146007 vendor=Cisco severity=error ...