I'm assuming the core hitting 100% is a Firewall Worker core (kernel instance) and not an SND/IRQ core.
After running "ips off" did you start a completely brand new FTP connection? If the FTP connection is already established and passing data, running "ips off" then will not have any effect as it is only applied to new connections.
As a test, try disabling APCL/URLF, installing policy and run the FTP transfer again. If it substantially improves (and I suspect it will) you need to rework your APCL/URLF policy to ensure FTP traffic does not match any rule invoking APCL/URLF. In an ordered layer this means the FTP traffic "falls off" the end of the APCL/URLF layer without matching any APCL/URLF rule at all. There is no way to define an explicit APCL/URLF rule to achieve this same effect.
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
New 2-day Live "Max Power" Series Course Now Available:
"Gateway Performance Optimization R81.20" at maxpowerfirewalls.com