I took a somewhat similar approach with my indexer. Not exactly though. When reindexing relays, 99% of events are indexed, and it would waste too much CPU time. Can go up to 100K events/s in. All events get batched, then get filtered by ID in the in-memory filter, then by the persistent filter (Badger store), then verified and then get forwarded to writers. A malicious relay could attempt to exhaust CPU resources but the events are tagged with the source relay.