The security logs can be quite voluminous on a busy AD server.
First, you say you are "pulling" the logs. If you are using WMI, you will probably have far better results using the Universal Forwarder on each. WMI is better than it used to be, but it doesn't hold a candle to the UF for being efficient. So if it is the case that you are using WMI, I'd start by installing the UF and configuring it to send in what you want.
After that change, if necessary, or if you are already using the UF, then I'd check how much CPU, RAM and Disk IO are in use by the servers both with and without the UF. You may be pushing the edge of the servers capabilities regardless of Splunk, and in that case you either need to increase the specs for the servers or add more AD servers. If this is happening only on a few, perhaps they are under spec. Or if they're in their own site, maybe it's only one site that needs another AD server or two.
Lastly, you can tune the UF a bit - I'm not sure it really cuts down on the server's load but it's worth a try to look at the events coming in. If you can identify large chunks of those that you don't need it COULD help to blacklist them [Note 1]. This won't really help much until you've done both of the above - making sure you are using the UF and making sure the servers aren't too heavily loaded already.
[1] Some group policy notifications come to mind - search your Splunk over the past hour with something like ... | stats count by EventCode and look closely at the top 3 or 4 and see if you need them for anything.
