dovecot/auth CPU spikes

[nicolas at andrillon.net]

Full dovecot -n output
=================
# 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.13 (7b14904)
# OS: Linux 3.14.32-xxxx-grs-ipv6-64 x86_64 Ubuntu 16.04.1 LTS ext4
auth_cache_size = 10 M
auth_mechanisms = plain login
default_internal_user = vmail
first_valid_uid = 0
mail_location = maildir:/home/data/vmail/%d/%n
mail_plugins = " fts fts_solr"
mail_privileged_group = vmail
maildir_stat_dirs = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace inbox {
 inbox = yes
 location =
 mailbox Archive {
 auto = subscribe
 special_use = Archive
 }
 mailbox Drafts {
 auto = subscribe
 special_use = Drafts
 }
 mailbox Junk {
 auto = subscribe
 special_use = Junk
 }
 mailbox Sent {
 auto = subscribe
 special_use = Sent
 }
 mailbox "Sent Messages" {
 special_use = Sent
 }
 mailbox Trash {
 auto = subscribe
 special_use = Trash
 }
 prefix =
}
passdb {
 args = /etc/dovecot/dovecot-sql.conf.ext
 driver = sql
}
plugin {
 antispam_backend = pipe
 antispam_mail_notspam = learn_ham
 antispam_mail_sendmail = /usr/bin/rspamc
 antispam_mail_sendmail_args = -h;localhost:11334;-P;q1
 antispam_mail_spam = learn_spam
 antispam_spam = Junk
 antispam_trash = Trash
 fts = solr
 fts_solr = break-imap-search url=http://localhost:8080/solr/
 sieve = file:~/sieve;active=~/.dovecot.sieve
 sieve_before = /var/lib/dovecot/sieve.d/
}
postmaster_address = postmaster at domain.net
protocols = imap lmtp sieve pop3
service auth-worker {
 unix_listener auth-worker {
 user = vmail
 }
 user = vmail
}
service auth {
 unix_listener /var/spool/postfix/private/auth {
 group = postfix
 mode = 0666
 user = postfix
 }
 unix_listener auth-userdb {
 group = vmail
 mode = 0660
 user = vmail
 }
 user = vmail
}
service imap-login {
 inet_listener imap {
 port = 0
 }
 service_count = 1
}
service lmtp {
 unix_listener /var/spool/postfix/private/dovecot-lmtp {
 group = postfix
 mode = 0666
 user = postfix
 }
 user = vmail
}
service pop3-login {
 inet_listener pop3 {
 port = 0
 }
}
ssl = required
ssl_cert =