Block icmp don't even fix the cpu issue though, the router still use cpu to decide which packet should be blocked.

If you really care about the cpu usage, you should drop raw traffic instead (when dos from certain ip is detected)