Hello colleagues!
We have some switches in different local networks the following configuration :
 

 Hardware Version     - T1600G-28TS 3.0
 Software Version     - 3.0.0 Build 20180130 Rel.33015(s)
 Bootloader Version   - TP-LINK  BOOTUTIL(v1.0.0)

 

They hang after a few days and port downlink on the upstream switch is up, MAC address of the switch is visible, but telnet / web for switch not available. It helps only physical reboot. Also observed lost ping packets  at about 5-10%. We also inspect traffic in vlan via wireshark, but there is nothing abnormal.
+ every 10 minutes we observed, that CPU Utilization is 90%.

We have no active customers on these switches. Switches from a similar configuration version 2.0 work fine. We are seeing a problem only on version 3.0.
Please consider our appeal and inform what the reason may be.
Switch configuration attached.

!T1600G-28TS
#
vlan 978
 name "management"
#
vlan 1358
#
hostname "XXXXX"
location "XXXXX"
contact-info "XXXXX"
#
logging host index 1 x.x.x.x 6
logging host index 2 x.x.x.x 6
#
system-time ntp UTC+02:00 x.x.x.x x.x.x.x
system-time dst predefined Europe
#
#
#
user name xxx privilege admin password 7 111
user name xxx privilege admin password 7 222
user name xxx privilege admin secret 5 333
service password-encryption
#
#
ip dhcp filter
#
ip dhcp snooping
ip dhcp snooping vlan 1358
#
#
#
#
ip dos-prevent  
ip dos-prevent type land
ip dos-prevent type scan-synfin
ip dos-prevent type xma-scan
ip dos-prevent type null-scan
ip dos-prevent type port-less-1024
ip dos-prevent type blat
ip dos-prevent type ping-flood
ip dos-prevent type syn-flood
ip dos-prevent type win-nuke
ip dos-prevent type smurf
ip dos-prevent type ping-of-death
#
ip arp inspection
#
#
spanning-tree
spanning-tree mode rstp
#
snmp-server
snmp-server community "xxxx" read-only "viewDefault"
#
#
ip route 0.0.0.0 0.0.0.0 x.x.x.x
#
#
 
#
#
loopback-detection
loopback-detection recovery-time 30
#
#
#
#
#
interface vlan 1
  no ip address
  no ipv6 enable
#
interface vlan 978
  ip address x.x.x.x 255.255.255.0
  no ipv6 enable
#
interface gigabitEthernet 1/0/1-23
switchport general allowed vlan 1358 untagged
  switchport pvid 1358
  no switchport general allowed vlan 1
  mac address-table max-mac-count max-number 16
  storm-control broadcast 512
  storm-control multicast 512
  ip dhcp filter
  ip dhcp filter decline rate 10
  ip arp inspection limit-rate 20
  port isolation gi-forward-list 1/0/24,1/0/28
  spanning-tree
  spanning-tree common-config portfast enable
  spanning-tree bpduguard
   
  loopback-detection config process-mode port-based recovery-mode auto
  loopback-detection
 
#
interface gigabitEthernet 1/0/24
  description "uplink"
  switchport general allowed vlan 978,1358 tagged
  no switchport general allowed vlan 1
  ip arp inspection trust
   
#
interface gigabitEthernet 1/0/25
   
#
interface gigabitEthernet 1/0/26
   
#
interface gigabitEthernet 1/0/27
   
#
interface gigabitEthernet 1/0/28
  description "uplink-fiber"
  switchport general allowed vlan 1358 tagged
  ip arp inspection trust
  spanning-tree
   
#
end
\00