What do you recommend first?
It depends on the character of your clients (as in "customers"). If none of them operated a server that needs to be reachable from the internet, you could actually implement a simple stateful firewall, whose first rule in chain
forward of
/ip firewall filter would say
action=accept connection-state=established,related, i.e. it would accept all packets belonging to already recognized connections, so the vast majority of all packets would ever reach only this single rule; the next rule would selectively accept only packets with
in-interface=LAN no matter the source or destination, and the third rule would drop the rest, again no matter the source or destination. Some minor additions to this basics may be added, find how the default firewall is made by Mikrotik in
/system default-configuration print.
All those blacklists should only block incoming connections initiated by sources in the internet, towards the router itself (so firewall chain
input) and, since there are a few servers of your customers towards which you have the
action=dst-nat rules configured, also towards these servers.
There is little point in preventing clients from actively connecting to blacklisted servers in the internet, unless you know which ones of them are spreading malware via the services they provide; the 3rd party blacklists usually contain active spammers, not infected websites.
So try to place the following three rules to the beginning of the forward chain of
/ip firewall filter:
chain=forward connection-state=established,related action=accept
chain=forward connection-state=invalid action=drop
chain=forward in-interface=LAN action=accept
You should also add an
action=drop in-interface=!LAN connection-nat-state=!dstnat
to the very end of chain forward.
Adding these four rules will lower the temperature of your hEX a little bit, and maybe even increase the throughput, whilst it will not lower the existing protection against incoming connections from the internet to the customers' servers. If that alone doesn't make the TikTok Live work, the only next step I can imagine is to stop caching the web pages - in fact, in the era of HTTPS, I don't believe the caching really saves a noticeable portion of the bandwidth.