Theroretically there is some "Recommended Capacity Values" in the Specification Sheet, "Based on typical network environments using average event and flow aggregation".
For ERC-4600 there is 24000EPS limit, and for ETM-5600 - 60000EPS limit. Typical (...) aggregation means around 10:1, so you can safely feed your ESM by 6000 aggregated events per second. You can use many of ERCs, but you should remeber about this ESM's limit.
There is no good answer for your question, because it is not easy to say something about real aggregation level in your environment.