When I run packet sniffer tool, I see some packets with size much larger than the MTU. Some as large as 10K or so.

Does packet sniffer combine tcp frames?

This is seen on RB4011, on the bridge interface, with all connected interfaces (vlan and ports) set at or around 1500.