You can't do anything on the firewall itself to decrease CPU utilization if it is caused by acl-drop'ed packets and service-policies won't help too (they will make things worse). The only feature that can help a little is "shun <ip>" (to block certain senders), because it lives earlier in the packet processing path than inbound ACL. Also, don't enable "service resetinbound" if you don't really need to (although it contributes a little). The only real solution is a powerful anti-DDoS product in front of Cisco firewall. And yes, it is well-known that dropped packets can cause higher CPU utilization than passed packets. The reason of this behavior is unknown.
On the other hand, "show traffic" and "show interface" count all dropped packets in accelerated security path. I'd analyze each drop counter separately by running "show asp drop" few times and calculating acl-drop rate over time manually. Also, it's hard to say if 12600 cps drop rate is critical for 2140. I would say no, it is not. It is possible that there is something else, e.g. high cps rate or high failover replication rate or combination of factors with high traffic rate. Check:
show cpu detailed
show resource usage
show asp event dp-cp
show perfmon detail
clear traffic + show traffic
