IPA unresponsive and high cpu usage of the ns-slapd process

Issue

• One of our IPA replica's is behaving oddly. 389ds is suspected.
• The replica is serving at most 60 systems
• ipactl commands take very long time
• ipactl restart sometimes fails
• high cpu usage by ns-slapd process
• high io utilisation (queue > 1) on the disk containing both the logging and the database files
• clients using this IPA server get odd results (does not know users anymore)
• kerberos not responsive (kinit takes a long time)
• kerberos however is responsive when SSS is configured to use a different replica but /etc/krb5.conf is using the 'odd' one
• DNS is working properly but probably using cache