Personal experience. 98% dropped via reputation filters.
1 Control Center - 8380 for the disk for log retention, incident, quarantines
2 Scanners - 8380's, maybe 3 in DMZ. I have 4 8380s doing about 8 million of which 2 boxes do 75% of the traffic. CPU utilization is around 20%, minimal swap, disk IO ~ 500 KB/second.
In the scanners you need the CPU/memory, but not the disk space. I wish they had a box between the 8360 & 8380.
What's your DR plan?