The host firewall does not respect the monitor parameter to the ct_lookup[46]() functions, it simply gathers it and discards, for example:

This means that even with monitorAggregationLevel=medium, aggregation of monitor notifications based on connections does not occur correctly for packets from the host towards the networks, meaning that notifications are generated once per packet rather than once every 5s per connection.

The monitor argument should be handled similarly to how it is used in bpf/bpf_lxc.c in the bpf_host.c.