Yes, PF is in use but states limit is not reached (usually only 1% usage).
Oh yes, good idea! I was under the impression that I've already disabled everything, but I've missed some features:
ix0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500...